US5491752A - System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens - Google Patents

System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens Download PDF

Info

Publication number
US5491752A
US5491752A US08/300,576 US30057694A US5491752A US 5491752 A US5491752 A US 5491752A US 30057694 A US30057694 A US 30057694A US 5491752 A US5491752 A US 5491752A
Authority
US
United States
Prior art keywords
workstation
password
token
hashing
user
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
US08/300,576
Inventor
Charles W. Kaufman
Radia J. Pearlman
Morrie Gasser
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hewlett Packard Development Co LP
Original Assignee
Digital Equipment Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Digital Equipment Corp filed Critical Digital Equipment Corp
Priority to US08/300,576 priority Critical patent/US5491752A/en
Application granted granted Critical
Publication of US5491752A publication Critical patent/US5491752A/en
Assigned to COMPAQ INFORMATION TECHNOLOGIES GROUP, L.P. reassignment COMPAQ INFORMATION TECHNOLOGIES GROUP, L.P. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: COMPAQ COMPUTER CORPORATION, DIGITAL EQUIPMENT CORPORATION
Assigned to HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P. reassignment HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: COMPAQ INFORMANTION TECHNOLOGIES GROUP LP
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/34User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/33User authentication using certificates
    • G06F21/335User authentication using certificates for accessing specific resources, e.g. using Kerberos tickets
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2103Challenge-response
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2151Time stamp

Definitions

  • the present invention relates to an improved method by which a user or other principal in a computing system may authenticate to a computer system and establish a shared secret key for the protection of subsequent messages, with reduced risk that the information in question will be improperly obtained or modified by a would-be intruder or imposter.
  • the invention pertains to a method by which a server in a distributed computing system may authenticate a user, authorizing access by the user to specified system resources and establishing a shared secret key with which to protect subsequent messages.
  • the invention pertains to a method by which an authentication server in a distributed computing system may transmit an authentication "ticket" to a user, authorizing access by the user to specified system resources.
  • the invention pertains to a method of increasing the difficulty of password guessing attacks in a distributed authentication scheme that employs authentication tokens.
  • resources such as one or more central processing units, main memories, disk and/or tape storage units, and printers.
  • Such a system may also include user terminals such as workstations; in many implementations, each user terminal may have its own local resources such as one or more central processing units, an associated main memory, a printer, and a disk or tape storage.
  • workstation includes other user terminals that are not necessarily sold as “workstations,” such as personal computers.
  • a "principal" e.g., a user desiring access to a system resource must identify himself to a security management authority with a user name and a password.
  • the security management authority may be part of the operating system of a timesharing computing system, or it may be an authentication server in a distributed computing system.
  • the user name and password typically are associated with an "account" on the computer system; each account normally has associated with it a set of access privileges to specified system resources.
  • a user normally attempts to log in to the system by, for example, entering a user name and a password at a workstation.
  • the security management authority checks whether the user name is associated with a valid account, and whether the password is the correct password for that account. If so, the security management authority presumes that the user is authorized to have access to system resources as specified for that account. That is, the user name and password, taken together, serve to identify and "authenticate" the user at login time.
  • An authentication system based solely on passwords and user names is open to attack by would-be intruders.
  • User names often are not difficult for unauthorized persons to determine; for example, a user name may be the publicly known electronic mail address of the user.
  • users when users are allowed to select their own passwords, they tend to choose passwords that are easily remembered; often these can be easily guessed as well.
  • one common threat to a password-based authentication system is an impostor that attempts to guess the password associated with a valid user name.
  • the impostor can perform an "exhaustive search" by quickly “guessing" large numbers of character sequences. When guesses are limited to common names and words taken from a list called a "dictionary,” this type of search is sometimes called a "dictionary attack" on the password.
  • a dictionary attack can be prevented fairly easily in a centralized computing system such as a timesharing system or a stand-alone computer, by authenticating users with the system's operating system software.
  • the operating system software Upon presentation of a user name and a password during a login procedure, the operating system software would verify the identity of the user by checking the presented user name and password against a list of valid user names and passwords. If too many wrong guesses occur, the operating system can intercede by disabling access to the account being attacked by, for example, disconnecting a dial-up telephone line or by disabling the account itself.
  • a dictionary attack can be more difficult to prevent in a distributed computing system.
  • several separate computer “subsystems” are typically linked together in a network to share various system resources. These systems generally lack a trusted central authority to implement a security policy for the system.
  • Each system resource on the network may implement its own security policy, in which each system resource is responsible for determining the access rights of each requester and allowing or rejecting the requested access.
  • each resource must enforce its own security policy, complexities of a kind not encountered in centralized computing environments are often seen. For example, if each system resource must maintain its own listing of all of the principals and their respective access rights and user names, then additional memory and maintenance is required for each resource. Further, if numerous system resources exist, then the addition or deletion of one or more principals would require the modification of numerous lists.
  • a global authentication service is a system resource that contains a list of all of the principals authorized to use the system and their names. Unlike a timesharing environment, where the naming service is centrally controlled, in a distributed environment the naming service is merely one of many system resources.
  • encryption using a secret encryption key shared by the workstation and the remote system resource is often used to preserve the confidentiality of the transmitted password when authenticating the user to remote nodes.
  • this type of protection is difficult to defeat with an exhaustive search, this method has practical logistical problems in that it is often difficult to establish the required keys between the workstation and the remote system resource.
  • the password is never passed between the workstation and the remote system resource; instead, the password is used as a key to encrypt information between the workstation and the remote system resource.
  • this method is subject to dictionary attacks using likely passwords to try and decrypt the messages.
  • a well-known cryptographic technique used to perform remote authentication is "public key" cryptography, illustrated in greatly simplified form in FIG. 2.
  • each principal has a public encryption key and a private encryption key.
  • the private key is known only to the owner of the key, while the public key is known to other principals in the system.
  • the public and private keys are mirror images of one another: messages encrypted with the public key can be decrypted only with the private key, and vice versa.
  • a sender encrypts the information with the recipient's public key. Because only the intended recipient has the complementary private key, only that recipient can decrypt it.
  • Public key cryptography is also called "asymmetric" encryption because information encoded with one key of the pair may be decoded only by using the other key in the pair.
  • R.S.A. encryption scheme discussed in U.S. Pat. No. 4,405,829 to Rivest et al. In R.S.A.
  • a principal's public and private keys are selected such that the encryption and decryption transformations that they effect are mutual inverses of each other and the sequential application of both transformations, in either order, will first encode the information and then decode it to restore the information to its original form.
  • Public key cryptography can be used in a login authentication exchange between a workstation, acting on behalf of a user, and a remote server.
  • a user logs into the workstation by typing in the user's password.
  • the workstation derives a secret, "symmetric" encryption key by applying a nonsecret (and indeed perhaps generally known) "hashing algorithm" to the password.
  • the workstation requests the user's private key from a directory service at the remote server.
  • the user's private key has previously been encrypted under the same secret encryption key and stored as part of a "credential" in the directory.
  • a credential is a table entry comprising the user's name, as well as the user's private key encrypted with the hashed password; in other words, the credential is a representation of the user in the computer.
  • the remote server returns the encrypted private key to the workstation, which uses the secret key to decrypt and obtain the private key.
  • a vulnerability of this password-based authentication is that the encrypted private key is transmitted over the network from the remote server to the workstation. Because knowledge of the password is not needed to initiate the request, an impostor can easily request a copy of the encrypted message. Equipped with a copy of the encrypted message, the impostor can attempt to decrypt the message by guessing various passwords and hashing them with the known hashing algorithm to form the secret key. In other words, the impostor need only request the encrypted message once and, thereafter, it can continuously attempt to decipher the message on its own computer without the risk of being audited or detected by the network. The impostor knows it has successfully derived the secret key and decrypted the message if the decrypted result yields an intelligible, valid private key. An impostor that can demonstrate possession of the private key may thus access system resources, purportedly on behalf of the user.
  • One known approach to solving this problem makes use of public key cryptography to enhance the security of a system that is primarily based on secret key authentication.
  • Such an approach employs a method to ensure that the contents of messages exchanged over the network are unintelligible to an impostor, even if the impostor has correctly decrypted a captured message.
  • the workstation generates a random bit string to which is concatenated a hashed version of the user's password.
  • This item of data is encrypted under the authentication server's public key and forwarded, together with the user name, as a message to the authentication server.
  • the authentication server decrypts the message with its private key and checks that the workstation supplied the correct hash total for the user's password.
  • the server creates a ticket for the user and performs an exclusive-OR function on the ticket and the random bit string.
  • the result of this latter operation is encrypted under the user's password hash value and returned as a message to the workstation. Because the impostor does not know the random bit string, it cannot distinguish between successful and unsuccessful decryptions of the message. This is because there is no information in a successfully decrypted message that would indicate that the decryption was successful.
  • An example of this approach is discussed in Lomas et al., "Reducing Risks from Poorly Chosen Keys," 12th Symposium on Operating System Principles, 1989, pp. 14-18.
  • the authentication server of the secret key system then, must have knowledge of the user's password. If the authentication server is compromised by an impostor, the impostor could use its knowledge of the password to impersonate the user.
  • a significant advantage of a public key cryptography system lies in the fact that only the user has access to the user's private key. Yet, the lack of a trusted, on-line agent to oversee the login process makes the described form of public key distributed system particularly vulnerable to a dictionary attack.
  • KERBEROS USING A SHARED SECRET KEY FOR TRANSMISSION OF AN AUTHENTICATION "TICKET"
  • Kerberos The well-known Kerberos network environment employs another variation on the basic password-authentication approach, which gives rise to a need to establish a shared secret key between the user's workstation and a remote authentication server.
  • An example of such a system is illustrated in greatly simplified form in FIG. 4.
  • the authentication server uses this shared key to encrypt a "ticket" that, upon successful decryption by the workstation, gives the workstation the ability to access services in the network. If an eavesdropper can capture the encrypted ticket and decipher it, the eavesdropper can impersonate the user.
  • the shared key used to encrypt the ticket is based on the user's password; the authentication server knows the user's password because it is stored at the authentication server, and the workstation learns the password when the user types it in at login time. More specifically, a hash of the password is typically used to form the key since the password is an alphanumeric string and the key commonly must be a number. However, as discussed above, any user-selected password is vulnerable to dictionary attack.
  • authentication token generators provide some sort of authenticating code that a user or a workstation utilizes in accessing a computing system.
  • One example of an authentication token generator is referred to colloquially as the "smart card.”
  • the authentication token generator is a "stand-alone" device that commonly resembles a credit card or calculator with a window that continuously displays a number that changes every few seconds. This number, which is called a “token,” is typically a function of (a) the date and time and (b) a secret key, unique to the particular token generator, that is stored in the token generator and also is known to the authentication server.
  • This type of token generator will be referred to herein as a "passive" token generator, because it continuously provides tokens without requiring any user input.
  • Another known type of authentication token generator provides a token that is a function of (1) a secret key unique to the authentication token generator, and (2) a "challenge” value supplied by the server and entered by the user into the keyboard of the authentication token generator.
  • This type of token generator will be referred to as an "active" token generator, since it actively provides a particular token in response to a specific user input.
  • a user To login at a workstation, a user first receives a token furnished by the authentication token generator, typically by reading the token from the token generator's display. Then the user types the token in at the workstation's keyboard, and the workstation sends the token to the authentication server.
  • the authentication server which knows the token generator's secret key, performs the same computations as the token generator to generate a token and compares it with the token typed by the user. If a match is not obtained, the authentication server rejects the login attempt. Often, an authentication token is used in addition to a user-chosen password.
  • An authentication token generator reduces the vulnerability of users who pick poor passwords that are easy to guess, but the device cannot be readily applied to a network environment such as Kerberos, where the workstation at which the user logs in also must securely receive a ticket from the authentication server.
  • the user could type the token and password into a workstation, and the workstation could forward something based on the token and/or the password to Kerberos for purposes of authentication.
  • a problem remains, in that a key must be established to encrypt the ticket that Kerberos sends to the workstation:
  • Both the workstation and the authentication server know the user's password.
  • the password is unsuitable as a shared key, however, because it is potentially subject to a dictionary attack;
  • Both the workstation and the authentication server know, or can compute, the token.
  • the token must be short enough for the user to enter reliably, however.
  • the token cannot practically be more than about 8 or 9 digits and thus is subject to attack via exhaustive search;
  • the secret key stored in the token generator would be a sufficiently secure shared key, but the workstation knows only the token that the user has typed in, not the secret key itself.
  • An illustrative system in accordance with the present invention is directed at the problems set forth above.
  • a workstation exchanges data with an authentication server to obtain access to a desired computing system, which may include the authentication server. Communications within this system are secure whether or not the connection between the workstation and the authentication server is subject to eavesdropping.
  • An exemplary embodiment of the invention is implemented in a computing network that includes an authentication server, as well as one or more workstations that may be connected to a number of resources, such as disk storage mechanisms, communications equipment, printers, and other computers.
  • the workstations interact with one or more authentication token generators and one or more users.
  • each workstation additionally includes a passive token generator that provides a unique, ongoing sequence of "tokens" as a function of time.
  • the user initiates communications with the authentication server by entering his "password” into the workstation.
  • the user additionally enters a token provided by the passive token generator.
  • the workstation calculates a "transmission code” by applying a first, cryptographically secure hashing algorithm to the password and the token, so that this information can be securely sent to the server.
  • the server Upon receiving the transmission code, the server attempts to determine the token and the password upon which the transmission code was calculated. More particularly, the server utilizes another passive token generator that generates tokens substantially identical to those of the workstation's token generator to identify possible tokens that might have been generated just prior to the server's receipt of the transmission code; moreover, the server retrieves a stored list of all passwords from disk storage.
  • the server sends the workstation a message encrypted using a secret key that comprises a session code computed by applying a second cryptographically secure hashing algorithm to the password and token.
  • the first and second hashing algorithms are substantially different.
  • the workstation may use the message (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired computing system.
  • the user initiates communications with the authentication server by entering the user's user name into the workstation.
  • the workstation transmits the user name to the authentication server.
  • the server verifies that the user name is a valid user name, in that it corresponds to an approved user of the computing network.
  • the workstation and the server are provided with substantially identical active token generators that function to provide a unique "response" upon receipt of a "challenge.”
  • the server (1) arbitrarily selects a "challenge,” (2) uses its active token generator to obtain the "response” to the challenge, and (3) generates a session code by performing a hashing algorithm upon the response and the user's password.
  • the server uses the session code as a secret key to encrypt a message, and then transmits the encrypted message along with the challenge to the workstation.
  • the workstation displays the received challenge to the user, who inputs it into the second active token generator; the second active token generator then supplies the unique response to the user.
  • the user enters the unique response into the workstation, and the workstation then generates the session code based upon the user's password and the unique response. Then the workstation uses the session code to decrypt the encrypted message.
  • the workstation may use the decrypted message (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired computing system.
  • FIG. 1 is a block diagram of a typical password-based access control system
  • FIG. 2 is a data flow diagram of a typical public key encryption transmission
  • FIG. 3 is a data flow diagram of a public key authentication transaction
  • FIG. 4 is a data flow diagram of an authenticated Kerberos network environment
  • FIG. 5 is a block diagram illustrating a computer-based network 500 in which the present invention may be implemented
  • FIG. 6 is a flowchart illustrating a routine 600 of a first implementation of the present invention.
  • FIG. 7 is a flowchart illustrating a routine 700 of a second implementation of the present invention.
  • the present invention may be implemented in a computing network such as the network 500 of FIG. 5, where each hardware component may be a conventional, commercially available product.
  • the network 500 includes an authentication server 502, which restricts unauthorized users from accessing the network 500, and "authenticates" proper users of the network 500.
  • the server 502 may be a VAX model computer such as the VAX 6000, manufactured by Digital Equipment Corporation, or any other desired computer capable of being programmed to function as a conventional authentication server.
  • the server 502 of course could perform other functions as well, for example, as would a workstation in a peer-to-peer network.
  • the authentication server 502 is connected to a passive authentication token generator 503 to assist the authentication server 502 in interacting with one or more users 512, 514, which utilize the services of the network 500.
  • the token generator 503 may be a routine executing as part of the control programming of the authentication server 502; of course, the token generator 503 could equivalently be implemented in separate hardware, such as a suitably programmed general purpose processor or a dedicated "hard wired" circuit.
  • each user 512, 514 is provided with a workstation 516, 518.
  • Each workstation 516, 518 may be connected to a number of resources such as one or more disk storage mechanisms 504; communications equipment 506 such as modems (not shown); printers 508; secondary computers 510; and other equipment 511.
  • FIG. 5 only shows a limited number of interconnections and components.
  • Each user 512, 514 is also provided with a passive authentication token generator 520, 522 to assist the user 512, 514 in interacting with the authentication server 502.
  • the token generators 520, 522 may, for example, comprise units such as SecurIDTM units made by Security Dynamics, Inc of Cambridge, Mass. As described in greater detail below, the token generators 520, 522 may instead comprise active token generators, in accordance with an alternative embodiment of the invention.
  • the server 502 when a user 512 or 514 verifies his identity to the server 502, the server 502 provides the workstation 516 or 518 with an encrypted message.
  • This message may comprise, for example, a "ticket” that is useful in "logging in” to a desired computing system such as a Kerberos network, the network 500, or another network, for a selected time period.
  • the message may comprise data to be used in encrypting and decrypting subsequent communications between the workstation 516 or 518 and the desired computing system.
  • the description herein will refer to the user 512 and the workstation 516, although this description is equally applicable to the user 514 and the workstation 518, and to other workstations (not shown) that may be connected to the server 502.
  • the workstation 516 receives: (1) the user name of the user 512, which identifies the user 512 to the network 500; (2) the "password" of the user 512, which comprises a sequence of numeric, alphabetic, alphanumeric, or other characters unique to the user 512; and (3) a token, obtained from the token generator 520.
  • the workstation 516 receives the user name, password, and token from the user 512, who enters these items on a keyboard (not shown) associated with the workstation 516.
  • the token may be communicated directly to the workstation 516 from the token generator 520 via a bar code reader, electrical link, radio link, or other automated means.
  • the token generator 520 comprises a device such as a "smart card” (not shown), which provides a continuous sequence of non-predictable numbers determined by performing a mathematical operation on a number supplied by a clock (not shown) contained in the token generator 520.
  • a clock not shown
  • the token may be computed based upon a constantly changing source, such as a stock market ticker, that is available to both of the token generators 503, 520.
  • the workstation 516 computes a "transmission code” based upon the password and the token.
  • the transmission code is calculated by using a first "hashing algorithm.”
  • hashing algorithm is used to describe a one-way routine for transmuting multiple input data items, by concatenating selected items of the input data and performing a "hashing equation” upon one or more items of the input data, in a specified order.
  • hashing equation is understood to include any one-way routine for transmuting a single input data item of numeric, alphabetic, or alphanumeric characters into an output sequence of characters, wherein the input data item cannot be readily derived from the output sequence.
  • Hashing equations are also understood to be consistent, in that each time a particular hashing equation is performed on a given input data item, the hashing equation produces the same output sequence.
  • the first hashing algorithm utilizes a hashing equation such as RSA Data Security's RSA MD2, RSA MD4, or RSA MD5, or the National Institute for Science and Technology proposal entitled "DHA" (Digital Hash Algorithm).
  • the first hashing algorithm may comprise any of the exemplary hashing algorithms 1.0-1.3, set forth below.
  • the hashing algorithm 1.0 comprises the following operations: the password is modified by the selected hashing equation, the modified password is concatenated onto the token to form a concatenation, and this concatenation is modified by the hashing equation.
  • the system may be designed so that a specified single hashing algorithm, such as one of the algorithms 1.0-1.3, is used at all times; alternatively, a number of variations are contemplated, such as the use of a selected algorithm during specified time periods by specified workstations, and the like.
  • the workstation 516 sends the transmission code to the server 502 in task 608.
  • the server 502 in task 610 attempts to identify the token used by the workstation 516 in calculating the transmission code.
  • the server 502 utilizes its token generator 503, as well as a memory (not shown) where the server 502 maintains a listing of the most recent tokens provided by the token generator 503.
  • the token generator 503 also contains a clock (not shown) that is substantially synchronized with the clocks of the token generators 520, 522. The token generator 503 is thus able to provide a sequence of characters that is identical to the characters provided by the token generators 520, 522.
  • the server 502 Based on the time at which the server 502 received the transmission code in task 608, the server 502 estimates a "window" of time during which the transmission code was likely to have been sent. By retrieving from memory all tokens produced by the token generator 503 during the window of time, the server 502 effectively compiles a list of tokens that includes the token used by the workstation 516 to calculate the transmission code in task 606.
  • the server 502 in task 612 accesses a list cross-referencing the user names and passwords of all users 512, 514 of the network 500.
  • the server 502 searches this list for the user name received in task 604, and then identifies the password of the user 512.
  • the server 502 attempts to duplicate the transmission code received in task 608. Specifically, the server 502 calculates all possible transmission codes, based on all possible combinations of the identified password and a different possible token. To arrive at the same transmission code calculated in task 606, the server 502 utilizes the first hashing algorithm used by the workstation 516 in task 606. As discussed above, the first hashing algorithm may comprise one of the exemplary first hashing algorithms 1.0-1.3.
  • the server 502 in task 612 accesses a list cross-referencing hashed user names with hashed passwords.
  • the server 502 performs the proper hashing equation on the user name, and searches the list to identify the hashed password cross-referenced against the hashed user name.
  • the server 502 proceeds in task 614 to repetitively perform the appropriate calculation needed to obtain the transmission code.
  • This embodiment is applicable when the session code is calculated from data comprising a token and a hashed password, using a hashing algorithm such as the hashing algorithm 1.0 or 1.1.
  • Still another embodiment is contemplated, wherein the server 502 in task 612 retrieves a list containing only passwords or hashed passwords.
  • the server 502 in task 614 repetitively performs the proper hashing algorithm upon possible tokens and possible passwords or possible hashed passwords to produce the transmission code, methodically progressing through every possible combination of token and password or hashed password. Unlike the embodiments described above, in this embodiment, it is unnecessary for the workstation 516 to transmit the user name in task 604, since all passwords from the stored list are sequentially tried.
  • query 616 asks whether any of the repetitive calculations of task 614 yielded the transmission code received by the server 502 in task 608. If not, then the server 502 concludes that the combination upon which the transmission code was based is invalid, and the server 502 denies access to the user 512 in task 618, and ends in task 632.
  • the server 502 in task 620 computes a session code by performing a second hashing algorithm on the password and the token.
  • the second hashing algorithm is substantially different than the first hashing algorithm calculated in task 606.
  • the second hashing algorithm differs from the first hashing algorithm in that it (1) utilizes a different hashing equation, (2) utilizes the same hashing equation, but operates upon the password and token in a different order, or (3) or otherwise differs substantially from the first hashing algorithm of task 606, such that the session code cannot be readily derived from the transmission code. In this way, even if an eavesdropper were to learn of the transmission code, the eavesdropper could not calculate the session code.
  • the second hashing algorithm comprises any one of the illustrative hashing algorithms 1.0-1.3 (described above), but not the same hashing algorithm as the first hashing algorithm used in task 606.
  • the server 502 in task 622 After computing the session code in task 620, the server 502 in task 622 encrypts a message using the session code as a secret key, and in task 624 sends the encrypted message to the workstation 516.
  • the workstation 516 calculates the session code in task 626, and decrypts the message using the session code as a secret key in task 628. Then, in task 630 the workstation may use the message: (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired system.
  • the workstation 516 uses the active token generator 520 to assist in decrypting a message received from the server 502.
  • the workstation 516 initiates communications with the authentication server 502 by transmitting the user name of the user 512.
  • the server 502 provides the workstation 516 with a "challenge” and a message encrypted with a session code comprising a hashed combination of a "response” and the password of the user 512.
  • the message may be decrypted by the following sequence of events: the user 512 inputs the challenge into the active token generator 520 to obtain the response, the user 512 inputs the obtained response into the workstation 516, the workstation 516 reproduces the session code, and the workstation 516 uses the session code as a secret key to decrypt the message according to a predetermined encryption algorithm.
  • routine 700 shown in FIG. 7.
  • the workstation 516 in task 704 receives the user name of the user 512.
  • the workstation 516 receives the user name from the user 512, who enters the user name on a keyboard (not shown) associated with the workstation 516.
  • the workstation 516 in task 706 sends the user name to the authentication server 502.
  • the server 502 arbitrarily selects a "challenge,” comprising an alphanumeric, numeric, or other character sequence.
  • the server 502 enters the challenge into the active token generator 503 to produce a given "response", unique to that challenge. The same challenge, when input into the token generator 520, would produce the identical response.
  • the server 502 identifies the password of the user 512 by consulting a list of cross-referenced user names and passwords. Then, in task 714 the server 502 generates a session code by performing a selected hashing algorithm upon the response and the password.
  • the session code may be calculated using any of the hashing algorithms 1.0-1.3 discussed above.
  • the server 502 in task 712 retrieves a list cross-referencing the user names with hashed passwords. In this case, the server 502 searches the list to identify the hashed password cross-referenced against the user name received in task 704. Having identified the hashed password of the user 512, the server 502 may then utilize the hashed password to calculate the session code.
  • the authentication server 502 in task 716 After calculating the session code, the authentication server 502 in task 716 encrypts a message using the session code as a secret key, and in task 718 transmits the encrypted message and the challenge to the workstation 516.
  • the workstation 516 displays the challenge to the user 512, and the user 512 inputs the challenge into the active token generator 520.
  • the token generator 520 provides the user 512 with the same response that was received by the server 502 in task 710.
  • the workstation 516 then receives the response; in an exemplary implementation of the invention, the workstation 516 receives the response from the user 512, who enters it on a keyboard (not shown) associated with the workstation 516.
  • the response may be communicated directly to the workstation 516 from the token generator 520 via a bar code reader, electrical link, radio link, or other automated means.
  • the workstation 516 in task 720 calculates the session code with the same hashing algorithm that was used by the authentication server 502 in task 714. As explained above, this algorithm may comprise any one of the hashing algorithms 1.0-1.3, in an exemplary embodiment.
  • the workstation 516 uses the calculated session code as a secret key to decrypt the message.
  • the workstation may use the message: (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired system.

Abstract

An improved security system inhibits eavesdropping, dictionary attacks, and intrusion into stored password lists. In one implementation, the user provides a workstation with a "password", and a "token" obtained from a passive authentication token generator. The workstation calculates a "transmission code" by performing a first hashing algorithm upon the password and token. The workstation sends the transmission code to the server. Then, the server attempts to reproduce the transmission code by combining passwords from a stored list with tokens generated by a second identical passive authentication token generator just prior to receipt of the transmission code. If any password/token combination yields the transmission code, the workstation is provided with a message useful in communicating with a desired computing system; the message is encrypted with a session code calculated by applying a different hashing algorithm to the password and token. In another embodiment, the workstation transmits a user name to the authentication server. The server verifies the user name's validity, and uses an active authentication token generator to obtain a "response" to an arbitrarily selected challenge. The server generates a session code by performing a hashing algorithm upon the response and the password. The server sends the challenge and a message encrypted with the session code to the workstation. The workstation generates the session code by performing the hashing algorithm on the password and the received challenge, and uses the session code to decrypt the encrypted message. The message is useful in communicating with a desired computing system.

Description

This application is a file-wrapper continuation, of application Ser. No. 08/034,225, filed Mar. 18, 1993, which is now abandoned.
BACKGROUND OF INVENTION
The present invention relates to an improved method by which a user or other principal in a computing system may authenticate to a computer system and establish a shared secret key for the protection of subsequent messages, with reduced risk that the information in question will be improperly obtained or modified by a would-be intruder or imposter.
In one aspect, the invention pertains to a method by which a server in a distributed computing system may authenticate a user, authorizing access by the user to specified system resources and establishing a shared secret key with which to protect subsequent messages. In a specific embodiment, the invention pertains to a method by which an authentication server in a distributed computing system may transmit an authentication "ticket" to a user, authorizing access by the user to specified system resources. In a related aspect, the invention pertains to a method of increasing the difficulty of password guessing attacks in a distributed authentication scheme that employs authentication tokens.
PASSWORD-BASED CONTROL OF ACCESS TO COMPUTER SYSTEM RESOURCES
Many large computing systems include "resources" such as one or more central processing units, main memories, disk and/or tape storage units, and printers. Such a system may also include user terminals such as workstations; in many implementations, each user terminal may have its own local resources such as one or more central processing units, an associated main memory, a printer, and a disk or tape storage. In the present application, it is understood that "workstation" includes other user terminals that are not necessarily sold as "workstations," such as personal computers.
Different approaches have been used to maintain the security of system resources from unauthorized access. Quite commonly, a "principal" (e.g., a user) desiring access to a system resource must identify himself to a security management authority with a user name and a password. (The masculine gender is used throughout this specification solely for convenience.) The security management authority may be part of the operating system of a timesharing computing system, or it may be an authentication server in a distributed computing system. The user name and password typically are associated with an "account" on the computer system; each account normally has associated with it a set of access privileges to specified system resources.
As illustrated in FIG. 1 in greatly simplified form, a user normally attempts to log in to the system by, for example, entering a user name and a password at a workstation. The security management authority checks whether the user name is associated with a valid account, and whether the password is the correct password for that account. If so, the security management authority presumes that the user is authorized to have access to system resources as specified for that account. That is, the user name and password, taken together, serve to identify and "authenticate" the user at login time.
DICTIONARY ATTACKS ON PASSWORD SECURITY
An authentication system based solely on passwords and user names is open to attack by would-be intruders. User names often are not difficult for unauthorized persons to determine; for example, a user name may be the publicly known electronic mail address of the user. Furthermore, when users are allowed to select their own passwords, they tend to choose passwords that are easily remembered; often these can be easily guessed as well. Indeed one common threat to a password-based authentication system is an impostor that attempts to guess the password associated with a valid user name. Through the use of an automated system configured to generate character sequences at a high rate, the impostor can perform an "exhaustive search" by quickly "guessing" large numbers of character sequences. When guesses are limited to common names and words taken from a list called a "dictionary," this type of search is sometimes called a "dictionary attack" on the password.
A dictionary attack can be prevented fairly easily in a centralized computing system such as a timesharing system or a stand-alone computer, by authenticating users with the system's operating system software. Upon presentation of a user name and a password during a login procedure, the operating system software would verify the identity of the user by checking the presented user name and password against a list of valid user names and passwords. If too many wrong guesses occur, the operating system can intercede by disabling access to the account being attacked by, for example, disconnecting a dial-up telephone line or by disabling the account itself.
COUNTERMEASURES AGAINST PASSWORD-AUTHENTICATION DICTIONARY ATTACKS IN DISTRIBUTED SYSTEMS
A dictionary attack can be more difficult to prevent in a distributed computing system. In such a system, several separate computer "subsystems" are typically linked together in a network to share various system resources. These systems generally lack a trusted central authority to implement a security policy for the system.
Each system resource on the network may implement its own security policy, in which each system resource is responsible for determining the access rights of each requester and allowing or rejecting the requested access. When each resource must enforce its own security policy, complexities of a kind not encountered in centralized computing environments are often seen. For example, if each system resource must maintain its own listing of all of the principals and their respective access rights and user names, then additional memory and maintenance is required for each resource. Further, if numerous system resources exist, then the addition or deletion of one or more principals would require the modification of numerous lists.
One known alternative is to utilize a central list that is accessible to all resources on the network. Because all system resources generally must have access to all of the principals and their names, a list of the principals and their names is often stored in a "global authentication service." A global authentication service is a system resource that contains a list of all of the principals authorized to use the system and their names. Unlike a timesharing environment, where the naming service is centrally controlled, in a distributed environment the naming service is merely one of many system resources.
COUNTERMEASURES AGAINST PASSWORD EAVESDROPPING
Another password-security problem, especially but not exclusively occurring in distributed computing systems, is that of the "eavesdropper." Because distributed systems generally have several workstations, it is desirable to allow a user to access the system resources regardless of which workstation he is logged into. However, all workstations on the network may not be equally trustworthy; for example, some workstations might be in secure and locked rooms while others might be publicly accessible. Moreover, many distributed systems require that a user who desires to use system resources located at various remote nodes must send his password to each node. In such an environment, unauthorized interception of the password by wiretapping the network may be possible, as illustrated in FIG. 1. If successful, eavesdropping can result in the impersonation of the user by an imposter who has intercepted the user's password.
To counter the eavesdropping threat, encryption using a secret encryption key shared by the workstation and the remote system resource is often used to preserve the confidentiality of the transmitted password when authenticating the user to remote nodes. Although this type of protection is difficult to defeat with an exhaustive search, this method has practical logistical problems in that it is often difficult to establish the required keys between the workstation and the remote system resource. In another technique, the password is never passed between the workstation and the remote system resource; instead, the password is used as a key to encrypt information between the workstation and the remote system resource. However, this method is subject to dictionary attacks using likely passwords to try and decrypt the messages.
REMOTE AUTHENTICATION VIA PUBLIC/PRIVATE KEY ENCRYPTION
A well-known cryptographic technique used to perform remote authentication is "public key" cryptography, illustrated in greatly simplified form in FIG. 2. In this method of secure communication, each principal has a public encryption key and a private encryption key. The private key is known only to the owner of the key, while the public key is known to other principals in the system. In effect, the public and private keys are mirror images of one another: messages encrypted with the public key can be decrypted only with the private key, and vice versa.
To effect a secure transmission of information to a recipient, a sender encrypts the information with the recipient's public key. Because only the intended recipient has the complementary private key, only that recipient can decrypt it. Public key cryptography is also called "asymmetric" encryption because information encoded with one key of the pair may be decoded only by using the other key in the pair. One example of a public key technique is the well-known R.S.A. encryption scheme discussed in U.S. Pat. No. 4,405,829 to Rivest et al. In R.S.A. cryptography, a principal's public and private keys are selected such that the encryption and decryption transformations that they effect are mutual inverses of each other and the sequential application of both transformations, in either order, will first encode the information and then decode it to restore the information to its original form.
Public key cryptography can be used in a login authentication exchange between a workstation, acting on behalf of a user, and a remote server. In a hypothetical example, shown in FIG. 3, a user logs into the workstation by typing in the user's password. The workstation derives a secret, "symmetric" encryption key by applying a nonsecret (and indeed perhaps generally known) "hashing algorithm" to the password. The workstation then requests the user's private key from a directory service at the remote server. The user's private key has previously been encrypted under the same secret encryption key and stored as part of a "credential" in the directory. (A credential is a table entry comprising the user's name, as well as the user's private key encrypted with the hashed password; in other words, the credential is a representation of the user in the computer.) The remote server returns the encrypted private key to the workstation, which uses the secret key to decrypt and obtain the private key.
A vulnerability of this password-based authentication is that the encrypted private key is transmitted over the network from the remote server to the workstation. Because knowledge of the password is not needed to initiate the request, an impostor can easily request a copy of the encrypted message. Equipped with a copy of the encrypted message, the impostor can attempt to decrypt the message by guessing various passwords and hashing them with the known hashing algorithm to form the secret key. In other words, the impostor need only request the encrypted message once and, thereafter, it can continuously attempt to decipher the message on its own computer without the risk of being audited or detected by the network. The impostor knows it has successfully derived the secret key and decrypted the message if the decrypted result yields an intelligible, valid private key. An impostor that can demonstrate possession of the private key may thus access system resources, purportedly on behalf of the user.
One known approach to solving this problem makes use of public key cryptography to enhance the security of a system that is primarily based on secret key authentication. Such an approach employs a method to ensure that the contents of messages exchanged over the network are unintelligible to an impostor, even if the impostor has correctly decrypted a captured message. According to the method, the workstation generates a random bit string to which is concatenated a hashed version of the user's password. This item of data is encrypted under the authentication server's public key and forwarded, together with the user name, as a message to the authentication server. The authentication server decrypts the message with its private key and checks that the workstation supplied the correct hash total for the user's password. If so, the server creates a ticket for the user and performs an exclusive-OR function on the ticket and the random bit string. The result of this latter operation is encrypted under the user's password hash value and returned as a message to the workstation. Because the impostor does not know the random bit string, it cannot distinguish between successful and unsuccessful decryptions of the message. This is because there is no information in a successfully decrypted message that would indicate that the decryption was successful. An example of this approach is discussed in Lomas et al., "Reducing Risks from Poorly Chosen Keys," 12th Symposium on Operating System Principles, 1989, pp. 14-18.
The authentication server of the secret key system, then, must have knowledge of the user's password. If the authentication server is compromised by an impostor, the impostor could use its knowledge of the password to impersonate the user. A significant advantage of a public key cryptography system lies in the fact that only the user has access to the user's private key. Yet, the lack of a trusted, on-line agent to oversee the login process makes the described form of public key distributed system particularly vulnerable to a dictionary attack.
KERBEROS: USING A SHARED SECRET KEY FOR TRANSMISSION OF AN AUTHENTICATION "TICKET"
The well-known Kerberos network environment employs another variation on the basic password-authentication approach, which gives rise to a need to establish a shared secret key between the user's workstation and a remote authentication server. An example of such a system is illustrated in greatly simplified form in FIG. 4. In Kerberos, the authentication server uses this shared key to encrypt a "ticket" that, upon successful decryption by the workstation, gives the workstation the ability to access services in the network. If an eavesdropper can capture the encrypted ticket and decipher it, the eavesdropper can impersonate the user.
In Kerberos, the shared key used to encrypt the ticket is based on the user's password; the authentication server knows the user's password because it is stored at the authentication server, and the workstation learns the password when the user types it in at login time. More specifically, a hash of the password is typically used to form the key since the password is an alphanumeric string and the key commonly must be a number. However, as discussed above, any user-selected password is vulnerable to dictionary attack.
One technique to counter the dictionary attack on passwords in a network environment is entitled "Method and Apparatus for Protecting the Confidentiality of Passwords in a Distributed Data Processing System", filed on Apr. 28, 1992 in the names of Charles W. Kaufman et al., and identified as U.S. Ser. No. 07/875,050; this technique requires the authentication server to receive proof that the user's workstation already knows the password before returning a ticket encrypted with the password as the key.
HARDWARE-BASED AUTHENTICATION "TOKENS"
Another known authentication method makes use of a separate item of hardware referred to as an "authentication token generator." Generally, authentication token generators provide some sort of authenticating code that a user or a workstation utilizes in accessing a computing system. One example of an authentication token generator is referred to colloquially as the "smart card." In some applications, the authentication token generator is a "stand-alone" device that commonly resembles a credit card or calculator with a window that continuously displays a number that changes every few seconds. This number, which is called a "token," is typically a function of (a) the date and time and (b) a secret key, unique to the particular token generator, that is stored in the token generator and also is known to the authentication server. This type of token generator will be referred to herein as a "passive" token generator, because it continuously provides tokens without requiring any user input.
Another known type of authentication token generator provides a token that is a function of (1) a secret key unique to the authentication token generator, and (2) a "challenge" value supplied by the server and entered by the user into the keyboard of the authentication token generator. This type of token generator will be referred to as an "active" token generator, since it actively provides a particular token in response to a specific user input.
To login at a workstation, a user first receives a token furnished by the authentication token generator, typically by reading the token from the token generator's display. Then the user types the token in at the workstation's keyboard, and the workstation sends the token to the authentication server. The authentication server, which knows the token generator's secret key, performs the same computations as the token generator to generate a token and compares it with the token typed by the user. If a match is not obtained, the authentication server rejects the login attempt. Often, an authentication token is used in addition to a user-chosen password.
An authentication token generator reduces the vulnerability of users who pick poor passwords that are easy to guess, but the device cannot be readily applied to a network environment such as Kerberos, where the workstation at which the user logs in also must securely receive a ticket from the authentication server. To use an authentication token generator with Kerberos, the user could type the token and password into a workstation, and the workstation could forward something based on the token and/or the password to Kerberos for purposes of authentication. A problem remains, in that a key must be established to encrypt the ticket that Kerberos sends to the workstation:
(a) Both the workstation and the authentication server know the user's password. The password is unsuitable as a shared key, however, because it is potentially subject to a dictionary attack;
(b) Both the workstation and the authentication server know, or can compute, the token. The token must be short enough for the user to enter reliably, however. The token cannot practically be more than about 8 or 9 digits and thus is subject to attack via exhaustive search;
(c) The secret key stored in the token generator would be a sufficiently secure shared key, but the workstation knows only the token that the user has typed in, not the secret key itself.
BRIEF SUMMARY OF THE INVENTION
An illustrative system in accordance with the present invention is directed at the problems set forth above. Under this system, a workstation exchanges data with an authentication server to obtain access to a desired computing system, which may include the authentication server. Communications within this system are secure whether or not the connection between the workstation and the authentication server is subject to eavesdropping. An exemplary embodiment of the invention is implemented in a computing network that includes an authentication server, as well as one or more workstations that may be connected to a number of resources, such as disk storage mechanisms, communications equipment, printers, and other computers. The workstations interact with one or more authentication token generators and one or more users.
In one embodiment of the invention, each workstation additionally includes a passive token generator that provides a unique, ongoing sequence of "tokens" as a function of time. The user initiates communications with the authentication server by entering his "password" into the workstation. The user additionally enters a token provided by the passive token generator. Then, the workstation calculates a "transmission code" by applying a first, cryptographically secure hashing algorithm to the password and the token, so that this information can be securely sent to the server.
Upon receiving the transmission code, the server attempts to determine the token and the password upon which the transmission code was calculated. More particularly, the server utilizes another passive token generator that generates tokens substantially identical to those of the workstation's token generator to identify possible tokens that might have been generated just prior to the server's receipt of the transmission code; moreover, the server retrieves a stored list of all passwords from disk storage.
If any password/token combination produces the received transmission code, that password and token constitute a valid combination, and the user should therefore be granted access to the desired computing system. Accordingly, the server sends the workstation a message encrypted using a secret key that comprises a session code computed by applying a second cryptographically secure hashing algorithm to the password and token. The first and second hashing algorithms are substantially different. After decrypting the message, the workstation may use the message (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired computing system.
In another illustrative embodiment of the invention, the user initiates communications with the authentication server by entering the user's user name into the workstation. The workstation transmits the user name to the authentication server. Upon receiving the user name, the server verifies that the user name is a valid user name, in that it corresponds to an approved user of the computing network.
In this embodiment, the workstation and the server are provided with substantially identical active token generators that function to provide a unique "response" upon receipt of a "challenge." After validating the user name, the server (1) arbitrarily selects a "challenge," (2) uses its active token generator to obtain the "response" to the challenge, and (3) generates a session code by performing a hashing algorithm upon the response and the user's password. The server uses the session code as a secret key to encrypt a message, and then transmits the encrypted message along with the challenge to the workstation.
The workstation displays the received challenge to the user, who inputs it into the second active token generator; the second active token generator then supplies the unique response to the user. The user enters the unique response into the workstation, and the workstation then generates the session code based upon the user's password and the unique response. Then the workstation uses the session code to decrypt the encrypted message. The workstation may use the decrypted message (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired computing system.
DESCRIPTION OF DRAWINGS
The nature of the invention, as well as objects and advantages thereof, will become more apparent to those skilled in the art after considering the following detailed description in connection with the accompanying drawings, in which like reference numerals designate like parts throughout, wherein:
FIG. 1 is a block diagram of a typical password-based access control system;
FIG. 2 is a data flow diagram of a typical public key encryption transmission;
FIG. 3 is a data flow diagram of a public key authentication transaction;
FIG. 4 is a data flow diagram of an authenticated Kerberos network environment;
FIG. 5 is a block diagram illustrating a computer-based network 500 in which the present invention may be implemented;
FIG. 6 is a flowchart illustrating a routine 600 of a first implementation of the present invention; and
FIG. 7 is a flowchart illustrating a routine 700 of a second implementation of the present invention.
DESCRIPTION OF SPECIFIC EMBODIMENTS Structure
The present invention may be implemented in a computing network such as the network 500 of FIG. 5, where each hardware component may be a conventional, commercially available product. The network 500 includes an authentication server 502, which restricts unauthorized users from accessing the network 500, and "authenticates" proper users of the network 500. The server 502 may be a VAX model computer such as the VAX 6000, manufactured by Digital Equipment Corporation, or any other desired computer capable of being programmed to function as a conventional authentication server. The server 502 of course could perform other functions as well, for example, as would a workstation in a peer-to-peer network. The authentication server 502 is connected to a passive authentication token generator 503 to assist the authentication server 502 in interacting with one or more users 512, 514, which utilize the services of the network 500. In one embodiment, the token generator 503 may be a routine executing as part of the control programming of the authentication server 502; of course, the token generator 503 could equivalently be implemented in separate hardware, such as a suitably programmed general purpose processor or a dedicated "hard wired" circuit.
In accordance with the invention, each user 512, 514 is provided with a workstation 516, 518. Each workstation 516, 518 may be connected to a number of resources such as one or more disk storage mechanisms 504; communications equipment 506 such as modems (not shown); printers 508; secondary computers 510; and other equipment 511. For clarity of illustration, FIG. 5 only shows a limited number of interconnections and components. Each user 512, 514 is also provided with a passive authentication token generator 520, 522 to assist the user 512, 514 in interacting with the authentication server 502. The token generators 520, 522 may, for example, comprise units such as SecurID™ units made by Security Dynamics, Inc of Cambridge, Mass. As described in greater detail below, the token generators 520, 522 may instead comprise active token generators, in accordance with an alternative embodiment of the invention.
Operation
According to the present invention, when a user 512 or 514 verifies his identity to the server 502, the server 502 provides the workstation 516 or 518 with an encrypted message. This message may comprise, for example, a "ticket" that is useful in "logging in" to a desired computing system such as a Kerberos network, the network 500, or another network, for a selected time period. Alternatively, the message may comprise data to be used in encrypting and decrypting subsequent communications between the workstation 516 or 518 and the desired computing system.
For explanatory purposes, the description herein will refer to the user 512 and the workstation 516, although this description is equally applicable to the user 514 and the workstation 518, and to other workstations (not shown) that may be connected to the server 502.
When the user 512 desires to obtain access to the desired computing system in accordance with the invention, the user 512 initiates the routine 600 in task 602 of FIG. 6. In task 604, the workstation 516 receives: (1) the user name of the user 512, which identifies the user 512 to the network 500; (2) the "password" of the user 512, which comprises a sequence of numeric, alphabetic, alphanumeric, or other characters unique to the user 512; and (3) a token, obtained from the token generator 520. In an exemplary implementation of the invention, the workstation 516 receives the user name, password, and token from the user 512, who enters these items on a keyboard (not shown) associated with the workstation 516. Alternatively, the token may be communicated directly to the workstation 516 from the token generator 520 via a bar code reader, electrical link, radio link, or other automated means.
In one embodiment of the invention, the token generator 520 comprises a device such as a "smart card" (not shown), which provides a continuous sequence of non-predictable numbers determined by performing a mathematical operation on a number supplied by a clock (not shown) contained in the token generator 520. Instead of using a clock, it is also contemplated that the token may be computed based upon a constantly changing source, such as a stock market ticker, that is available to both of the token generators 503, 520.
In task 606, the workstation 516 computes a "transmission code" based upon the password and the token. The transmission code is calculated by using a first "hashing algorithm." As used herein, "hashing algorithm" is used to describe a one-way routine for transmuting multiple input data items, by concatenating selected items of the input data and performing a "hashing equation" upon one or more items of the input data, in a specified order. As used herein, "hashing equation," is understood to include any one-way routine for transmuting a single input data item of numeric, alphabetic, or alphanumeric characters into an output sequence of characters, wherein the input data item cannot be readily derived from the output sequence. Hashing equations are also understood to be consistent, in that each time a particular hashing equation is performed on a given input data item, the hashing equation produces the same output sequence. In an exemplary embodiment of the invention, the first hashing algorithm utilizes a hashing equation such as RSA Data Security's RSA MD2, RSA MD4, or RSA MD5, or the National Institute for Science and Technology proposal entitled "DHA" (Digital Hash Algorithm).
In an illustrative implementation, the first hashing algorithm may comprise any of the exemplary hashing algorithms 1.0-1.3, set forth below.
______________________________________                                    
[1.0]         hash(token   hash(password))                                
[1.1]         hash(hash(password   token)                                 
[1.2]           hash(token   password)                                    
[1.3]           hash(password   token)                                    
______________________________________                                    
In the hashing algorithms 1.0-1.3, the " " symbol represents the concatenation operation. The hashing algorithm 1.0, explained more fully, comprises the following operations: the password is modified by the selected hashing equation, the modified password is concatenated onto the token to form a concatenation, and this concatenation is modified by the hashing equation. The system may be designed so that a specified single hashing algorithm, such as one of the algorithms 1.0-1.3, is used at all times; alternatively, a number of variations are contemplated, such as the use of a selected algorithm during specified time periods by specified workstations, and the like.
After the transmission code is computed in task 606, the workstation 516 sends the transmission code to the server 502 in task 608. Upon receiving the transmission code, the server 502 in task 610 attempts to identify the token used by the workstation 516 in calculating the transmission code. To identify the token, the server 502 utilizes its token generator 503, as well as a memory (not shown) where the server 502 maintains a listing of the most recent tokens provided by the token generator 503. In the illustrative implementation, the token generator 503 also contains a clock (not shown) that is substantially synchronized with the clocks of the token generators 520, 522. The token generator 503 is thus able to provide a sequence of characters that is identical to the characters provided by the token generators 520, 522. Based on the time at which the server 502 received the transmission code in task 608, the server 502 estimates a "window" of time during which the transmission code was likely to have been sent. By retrieving from memory all tokens produced by the token generator 503 during the window of time, the server 502 effectively compiles a list of tokens that includes the token used by the workstation 516 to calculate the transmission code in task 606.
Having compiled this list of possible tokens, the server 502 in task 612 then accesses a list cross-referencing the user names and passwords of all users 512, 514 of the network 500. The server 502 searches this list for the user name received in task 604, and then identifies the password of the user 512.
Then, in task 614 the server 502 attempts to duplicate the transmission code received in task 608. Specifically, the server 502 calculates all possible transmission codes, based on all possible combinations of the identified password and a different possible token. To arrive at the same transmission code calculated in task 606, the server 502 utilizes the first hashing algorithm used by the workstation 516 in task 606. As discussed above, the first hashing algorithm may comprise one of the exemplary first hashing algorithms 1.0-1.3.
In an alternate embodiment of the invention, the server 502 in task 612 accesses a list cross-referencing hashed user names with hashed passwords. In this embodiment, the server 502 performs the proper hashing equation on the user name, and searches the list to identify the hashed password cross-referenced against the hashed user name. After this, the server 502 proceeds in task 614 to repetitively perform the appropriate calculation needed to obtain the transmission code. This embodiment is applicable when the session code is calculated from data comprising a token and a hashed password, using a hashing algorithm such as the hashing algorithm 1.0 or 1.1. Still another embodiment is contemplated, wherein the server 502 in task 612 retrieves a list containing only passwords or hashed passwords. In this embodiment, the server 502 in task 614 repetitively performs the proper hashing algorithm upon possible tokens and possible passwords or possible hashed passwords to produce the transmission code, methodically progressing through every possible combination of token and password or hashed password. Unlike the embodiments described above, in this embodiment, it is unnecessary for the workstation 516 to transmit the user name in task 604, since all passwords from the stored list are sequentially tried.
After task 614, query 616 asks whether any of the repetitive calculations of task 614 yielded the transmission code received by the server 502 in task 608. If not, then the server 502 concludes that the combination upon which the transmission code was based is invalid, and the server 502 denies access to the user 512 in task 618, and ends in task 632.
However, if any of the repetitive calculations of task 614 yielded the transmission code received by the server 502 in task 608, this indicates that the token and password used in the successful calculation constitute a valid combination, and the user 512 should be provided with access to the desired system.
In this case, the server 502 in task 620 computes a session code by performing a second hashing algorithm on the password and the token. The second hashing algorithm is substantially different than the first hashing algorithm calculated in task 606. Specifically, the second hashing algorithm differs from the first hashing algorithm in that it (1) utilizes a different hashing equation, (2) utilizes the same hashing equation, but operates upon the password and token in a different order, or (3) or otherwise differs substantially from the first hashing algorithm of task 606, such that the session code cannot be readily derived from the transmission code. In this way, even if an eavesdropper were to learn of the transmission code, the eavesdropper could not calculate the session code. In an exemplary embodiment, the second hashing algorithm comprises any one of the illustrative hashing algorithms 1.0-1.3 (described above), but not the same hashing algorithm as the first hashing algorithm used in task 606.
After computing the session code in task 620, the server 502 in task 622 encrypts a message using the session code as a secret key, and in task 624 sends the encrypted message to the workstation 516. After the message is received by the workstation 516, the workstation 516 calculates the session code in task 626, and decrypts the message using the session code as a secret key in task 628. Then, in task 630 the workstation may use the message: (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired system.
Another implementation of the invention is contemplated wherein the token generators 503,520 are substantially identical "active" token generators, rather than "passive" token generators. The workstation 516 uses the active token generator 520 to assist in decrypting a message received from the server 502. In this embodiment, the workstation 516 initiates communications with the authentication server 502 by transmitting the user name of the user 512. The server 502 provides the workstation 516 with a "challenge" and a message encrypted with a session code comprising a hashed combination of a "response" and the password of the user 512. The message may be decrypted by the following sequence of events: the user 512 inputs the challenge into the active token generator 520 to obtain the response, the user 512 inputs the obtained response into the workstation 516, the workstation 516 reproduces the session code, and the workstation 516 uses the session code as a secret key to decrypt the message according to a predetermined encryption algorithm.
More specifically, these steps are performed according to a routine comprising a routine 700, shown in FIG. 7. After the routine 700 is initiated in task 702, the workstation 516 in task 704 receives the user name of the user 512. In an exemplary implementation of the invention, the workstation 516 receives the user name from the user 512, who enters the user name on a keyboard (not shown) associated with the workstation 516. Then, the workstation 516 in task 706 sends the user name to the authentication server 502. In task 708, the server 502 arbitrarily selects a "challenge," comprising an alphanumeric, numeric, or other character sequence. In task 710, the server 502 then enters the challenge into the active token generator 503 to produce a given "response", unique to that challenge. The same challenge, when input into the token generator 520, would produce the identical response.
In task 712, the server 502 identifies the password of the user 512 by consulting a list of cross-referenced user names and passwords. Then, in task 714 the server 502 generates a session code by performing a selected hashing algorithm upon the response and the password. As illustrative examples, the session code may be calculated using any of the hashing algorithms 1.0-1.3 discussed above.
In an alternate embodiment, the server 502 in task 712 retrieves a list cross-referencing the user names with hashed passwords. In this case, the server 502 searches the list to identify the hashed password cross-referenced against the user name received in task 704. Having identified the hashed password of the user 512, the server 502 may then utilize the hashed password to calculate the session code.
After calculating the session code, the authentication server 502 in task 716 encrypts a message using the session code as a secret key, and in task 718 transmits the encrypted message and the challenge to the workstation 516. In task 719, the workstation 516 displays the challenge to the user 512, and the user 512 inputs the challenge into the active token generator 520. The token generator 520 provides the user 512 with the same response that was received by the server 502 in task 710. The workstation 516 then receives the response; in an exemplary implementation of the invention, the workstation 516 receives the response from the user 512, who enters it on a keyboard (not shown) associated with the workstation 516. Alternatively, the response may be communicated directly to the workstation 516 from the token generator 520 via a bar code reader, electrical link, radio link, or other automated means. After receiving the response in task 719, the workstation 516 in task 720 calculates the session code with the same hashing algorithm that was used by the authentication server 502 in task 714. As explained above, this algorithm may comprise any one of the hashing algorithms 1.0-1.3, in an exemplary embodiment. In task 722 the workstation 516 uses the calculated session code as a secret key to decrypt the message. Then, in task 724 the workstation may use the message: (1) as a "ticket" to gain access to the desired system for a selected period of time, or (2) as a session-specific shared secret key to encrypt and decrypt subsequent communications with the desired system.
Conclusion
While there have been shown what are presently considered to be preferred embodiments of the invention, it will be apparent to those skilled in the art that various changes and modifications can be made herein without departing from the scope of the invention as defined by the appended claims.

Claims (37)

What is claimed is:
1. A method for securely accessing a computing system, comprising the steps of:
(a) a workstation receiving a token from a first passive authentication token generator and receiving a secret password associated with a user;
(b) the workstation generating a transmission code by performing a first hashing algorithm upon data comprising:
(1) the token and
(2) the secret password;
(c) the workstation sending the transmission code to an authentication server;
(d) the server receiving and verifying the validity of the transmission code;
(e) if the transmission code is valid, the server transmitting to the workstation a message encrypted with a session code generated by performing a second hashing algorithm upon data comprising the token and the password, the second hashing algorithm being substantially different than the first hashing algorithm;
(f) the workstation receiving the message;
(g) the workstation computing the session code by performing the second hashing algorithm on the password and the token; and
(h) the workstation using the session code to decrypt the message.
2. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:
(1) hashing the password according to a selected one-way hashing equation;
(2) concatenating the token onto the hashed password to form a concatenation; and
(3) hashing the concatenation according to the selected one-way hashing equation.
3. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:
(1) hashing the password according to a selected one-way hashing equation;
(2) concatenating the hashed password onto the token to form a concatenation; and
(3) hashing the concatenation according to the selected one-way hashing equation.
4. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:
(1) concatenating the token onto the password to form a concatenation; and
(2) hashing the concatenation according to the selected one-way hashing equation.
5. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:
(1) concatenating the password onto the token to form a concatenation; and
(2) hashing the concatenation according to the selected one-way hashing equation.
6. The method of claim 1, wherein the step of verifying the validity of the transmission code comprises the steps of:
(1) the server utilizing a second passive authentication token generator that simultaneously supplies tokens substantially identical to those of the first passive token generator to identify possible tokens occurring at the time the workstation sent the transmission code to the server;
(2) the server identifying one or more passwords from a stored list; and
(3) the server attempting to reproduce the transmission code by performing the first hashing algorithm on the identified one or more passwords and different identified possible tokens in turn.
7. The method of claim 6, wherein step (2) comprises the step of utilizing a user name received from the workstation to identify a single password from a cross-referenced list of user names and passwords.
8. The method of claim 1, wherein the step of verifying the validity of the transmission code comprises the steps of:
(1) the server utilizing a second passive authentication token generator that simultaneously supplies tokens substantially identical to those of the first passive token generator to identify possible tokens occurring at the time the workstation sent the transmission code to the server;
(2) the server identifying one or more hashed passwords from a stored list; and
(3) the server attempting to reproduce the transmission code by performing the first hashing algorithm on the identified one or more hashed passwords and different identified possible tokens in turn.
9. The method of claim 8, wherein step (2) comprises the step of utilizing a user name received from the workstation to identify a single hashed password from a cross-referenced list of user names and hashed passwords.
10. The method of claim 1, wherein the step of generating the session code comprises the steps of:
(1) hashing the password according to a selected one-way hashing equation;
(2) concatenating the token and the hashed password to form a concatenation; and
(3) hashing the concatenation according to the selected one-way hashing equation.
11. The method of claim 1, wherein the step of generating the session code comprises the steps of:
(1) hashing the token according to a selected one-way hashing equation;
(2) concatenating the hashed token and the password to form a concatenation; and
(3) hashing the concatenation according to the selected one-way hashing equation.
12. The method of claim 1, wherein the step of generating the session code comprises the steps of:
(1) concatenating the token onto the password to form a concatenation; and
(2) hashing the concatenation according to the selected one-way hashing equation.
13. The method of claim 1, wherein the step of generating the session code comprises the steps of:
(1) concatenating the password onto the token to form a concatenation; and
(2) hashing the concatenation according to the selected one-way hashing equation.
14. The method of claim 1, further comprising the step of the workstation using the message to encrypt subsequent communications between the workstation and a desired computing system.
15. The method of claim 1, further comprising the step of the workstation using the session code to decrypt subsequent communications between the workstation and a desired computing system.
16. The method of claim 1, additionally including the step of the authentication server maintaining a log of verified transmission codes.
17. The method of claim 1, wherein the step of the workstation receiving the password is accomplished by a user typing the password upon keys of a data entry device.
18. The method of claim 1, wherein the step of the workstation receiving the token is accomplished by a user typing the token upon keys of a data entry device.
19. The method of claim 1, wherein the token is generated by the first authentication token generator based upon an external reference.
20. The method of claim 1, wherein the step of the workstation receiving the token is accomplished by an electrical link.
21. The method of claim 1, wherein the step of the workstation receiving the token is accomplished by the workstation reading a bar code provided by the first authentication token generator.
22. A secure method for obtaining access to a computing system, wherein a workstation performs steps comprising:
(a) receiving an initial password and an initial token, wherein the initial password is supplied by a user and the initial token is supplied by a first authentication token generator;
(b) generating a transmission code by performing a first hashing algorithm upon the password and the token;
(c) sending the transmission code to an authentication server having a second authentication token generator that simultaneously supplies tokens substantially identical to those provided by the first authentication token generator;
(d) if the authentication server successfully reproduces the transmission code by performing successive calculations utilizing different combinations of possible tokens occurring at the time the transmission code was sent and one or more passwords identified from a list of passwords accessible by the authentication server, then receiving a message from the authentication server that is encrypted with a selected secret key routine using a session code obtained by performing a second hashing algorithm upon data comprising the initial token and the initial password, the second hashing algorithm being substantially different than the first hashing algorithm.
23. The method of claim 22, wherein the workstation additionally performs steps comprising:
(1) decrypting the message; and
(2) utilizing the message to encrypt subsequent communications with a desired computing system.
24. The method of claim 22, wherein the workstation additionally performs steps comprising:
(1) decrypting the message; and
(2) utilizing the message to decrypt subsequent communication with a desired computing system.
25. A secure method for obtaining access to a computing system,
wherein an authentication server performs steps comprising:
(a) receiving a transmission code from a workstation, the transmission code generated by performing a first hashing algorithm upon data comprising an initial password received from a user and an initial token provided by a first passive authentication token generator;
(b) utilizing a second passive authentication token generator that simultaneously provides tokens substantially identical to those supplied by the first passive authentication token generator to identify possible tokens occurring at the time the workstation sent the transmission code, identifying one or more passwords from a list of passwords accessible by the authentication server, and attempting to reproduce the transmission code by performing successive calculations utilizing different combinations of the possible tokens and one or more identified passwords;
(c) if the server in step (b) successfully reproduced the transmission code, then providing the workstation with a message encrypted with a selected secret key routine using a session code generated by performing a second hashing algorithm upon the initial token and the initial password, wherein the second hashing algorithm is substantially different than the first hashing algorithm.
26. In a system including a workstation, an authentication server, and a token generator, a signal comprising a hashed version of a first signal computed from data including a user-supplied password and a token supplied by a token generator.
27. In a system that includes a workstation and an authentication server, a signal comprising a hashed version of a first signal computed from data including a token supplied by a token generator and a user-supplied password.
28. A method for securely accessing a computing system, comprising the steps of:
(a) a workstation receiving a user name associated with a user;
(b) the workstation transmitting the user name to an authentication server;
(c) the authentication server verifying the validity of the user name, and if the user name is valid:
(1) selecting a challenge;
(2) obtaining a response by inputting the challenge into a first active authentication token generator;
(3) generating a session code by performing a first hashing algorithm on data comprising the response and a password associated with the user;
(4) encrypting a message with the session code;
(5) transmitting the challenge and the encrypted message to the workstation; and
(d) the workstation receiving the challenge and the encrypted message;
(e) the workstation obtaining the response by inputting the challenge into a second active authentication token generator that generates tokens substantially identical to those generated by the first active authentication token generator, and using the response and the password to generate the session code and decrypt the message.
29. The method of claim 28, wherein the step of the workstation receiving the user name is accomplished by the user typing the user name upon keys of a data entry device.
30. The method of claim 28, wherein the step of generating the session code comprises the steps of:
(1) concatenating the response onto a password associated with the user to form a concatenation; and
(2) hashing the concatenation according to the selected one-way hashing equation.
31. The method of claim 28, wherein the step of generating the session code comprises the steps of:
(1) concatenating a password associated with the user onto the response to form a concatenation; and
(2) hashing the concatenation according to the selected one-way hashing equation.
32. The method of claim 28, wherein the step of generating the session code comprises the steps of:
(1) hashing a password associated with the user according to a selected one-way hashing equation;
(2) concatenating the hashed password and the response to form a concatenation; and
(3) hashing the concatenation according to the selected one-way hashing equation.
33. The method of claim 28, wherein the step of generating the session code comprises the steps of:
(1) hashing the response according to a selected one-way hashing equation;
(2) concatenating the response and a password associated with the user to form a concatenation; and
(3) hashing the concatenation according to the selected one-way hashing equation.
34. The method of claim 28, wherein the step of verifying the validity of the user name comprises the step of the server accessing a database of user names and determining whether the user name appears in the database.
35. The method of claim 28, wherein the step of verifying the validity of the user name comprises the step of the server accessing a database of hashed user names and determining whether the user name appears in the database.
36. The method of claim 28, further comprising the step of the workstation using the message to encrypt subsequent communications between the workstation and a desired computing system.
37. The method of claim 28, further comprising the step of the workstation using the message to decrypt subsequent communications between the workstation and a desired computing system.
US08/300,576 1993-03-18 1994-09-02 System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens Expired - Lifetime US5491752A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US08/300,576 US5491752A (en) 1993-03-18 1994-09-02 System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US3422593A 1993-03-18 1993-03-18
US08/300,576 US5491752A (en) 1993-03-18 1994-09-02 System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US3422593A Continuation 1993-03-18 1993-03-18

Publications (1)

Publication Number Publication Date
US5491752A true US5491752A (en) 1996-02-13

Family

ID=21875076

Family Applications (1)

Application Number Title Priority Date Filing Date
US08/300,576 Expired - Lifetime US5491752A (en) 1993-03-18 1994-09-02 System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens

Country Status (1)

Country Link
US (1) US5491752A (en)

Cited By (204)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5661803A (en) * 1995-03-31 1997-08-26 Pitney Bowes Inc. Method of token verification in a key management system
US5664099A (en) * 1995-12-28 1997-09-02 Lotus Development Corporation Method and apparatus for establishing a protected channel between a user and a computer system
US5680470A (en) 1993-12-17 1997-10-21 Moussa; Ali Mohammed Method of automated signature verification
US5684950A (en) * 1996-09-23 1997-11-04 Lockheed Martin Corporation Method and system for authenticating users to multiple computer servers via a single sign-on
US5706349A (en) * 1995-03-06 1998-01-06 International Business Machines Corporation Authenticating remote users in a distributed environment
US5706427A (en) * 1995-09-08 1998-01-06 Cadix Inc. Authentication method for networks
US5720034A (en) * 1995-12-07 1998-02-17 Case; Jeffrey D. Method for secure key production
US5737422A (en) * 1995-04-26 1998-04-07 Billings; Roger E. Distributed data processing network
US5742759A (en) * 1995-08-18 1998-04-21 Sun Microsystems, Inc. Method and system for facilitating access control to system resources in a distributed computer system
US5764887A (en) * 1995-12-11 1998-06-09 International Business Machines Corporation System and method for supporting distributed computing mechanisms in a local area network server environment
WO1998025375A1 (en) * 1996-12-04 1998-06-11 V-One Corporation Token distribution and registration system and method
US5781725A (en) * 1995-05-23 1998-07-14 Nec Corporation Computer network system having a small of amount of data in a network
US5812764A (en) * 1997-01-30 1998-09-22 International Business Machines Password management system over a communications network
US5815574A (en) * 1994-12-15 1998-09-29 International Business Machines Corporation Provision of secure access to external resources from a distributed computing environment
US5826014A (en) * 1996-02-06 1998-10-20 Network Engineering Software Firewall system for protecting network elements connected to a public network
US5838903A (en) * 1995-11-13 1998-11-17 International Business Machines Corporation Configurable password integrity servers for use in a shared resource environment
US5841970A (en) * 1995-09-08 1998-11-24 Cadix, Inc. Authentication method for networks
US5841866A (en) * 1994-09-30 1998-11-24 Microchip Technology Incorporated Secure token integrated circuit and method of performing a secure authentication function or transaction
US5864667A (en) * 1995-04-05 1999-01-26 Diversinet Corp. Method for safe communications
WO1999005813A2 (en) * 1997-07-23 1999-02-04 Visto Corporation User authentication applet in a computer network
US5872917A (en) * 1995-06-07 1999-02-16 America Online, Inc. Authentication using random challenges
US5875296A (en) * 1997-01-28 1999-02-23 International Business Machines Corporation Distributed file system web server user authentication with cookies
US5892828A (en) * 1996-10-23 1999-04-06 Novell, Inc. User presence verification with single password across applications
US5892902A (en) * 1996-09-05 1999-04-06 Clark; Paul C. Intelligent token protected system with network authentication
US5898830A (en) * 1996-10-17 1999-04-27 Network Engineering Software Firewall providing enhanced network security and user transparency
US5943424A (en) * 1996-06-17 1999-08-24 Hewlett-Packard Company System, method and article of manufacture for processing a plurality of transactions from a single initiation point on a multichannel, extensible, flexible architecture
US5956409A (en) 1996-04-29 1999-09-21 Quintet, Inc. Secure application of seals
US6021496A (en) * 1997-07-07 2000-02-01 International Business Machines Corporation User authentication from non-native server domains in a computer network
WO2000007326A1 (en) * 1998-07-31 2000-02-10 Sun Microsystems, Inc. Methods and systems for establishing a shared secret using an authentication token
US6035406A (en) * 1997-04-02 2000-03-07 Quintet, Inc. Plurality-factor security system
US6064736A (en) * 1997-09-15 2000-05-16 International Business Machines Corporation Systems, methods and computer program products that use an encrypted session for additional password verification
WO2000030285A1 (en) * 1997-12-23 2000-05-25 Arcot Systems, Inc. Method and apparatus for secure distribution of authentication credentials to roaming users
US6079021A (en) * 1997-06-02 2000-06-20 Digital Equipment Corporation Method and apparatus for strengthening passwords for protection of computer systems
US6081898A (en) * 1993-12-29 2000-06-27 Microsoft Corporation Unification of directory service with file system service
US6107932A (en) * 1997-08-22 2000-08-22 Walker Digital, Llc System and method for controlling access to a venue using alterable tickets
US6119227A (en) * 1995-04-18 2000-09-12 Hewlett-Packard Company Methods and apparatus for authenticating an originator of a message
US6134597A (en) * 1997-05-28 2000-10-17 International Business Machines Corporation CRC hash compressed server object identifier
US6141758A (en) * 1997-07-14 2000-10-31 International Business Machines Corporation Method and system for maintaining client server security associations in a distributed computing system
US6148404A (en) * 1997-05-28 2000-11-14 Nihon Unisys, Ltd. Authentication system using authentication information valid one-time
WO2001026062A1 (en) * 1999-10-01 2001-04-12 Cardinalcommerce.Com, Inc. Secure and efficient payment processing system
WO2001031840A1 (en) * 1999-10-29 2001-05-03 Nokia Corporation Method and arrangement for reliably identifying a user in a computer system
US6233341B1 (en) 1998-05-19 2001-05-15 Visto Corporation System and method for installing and using a temporary certificate at a remote site
US6240396B1 (en) 1996-09-04 2001-05-29 Priceline.Com Incorporated Conditional purchase offer management system for event tickets
EP1131911A1 (en) * 1998-11-19 2001-09-12 Arcot Systems, Inc. Method and apparatus for secure distribution of authentication credentials to roaming users
US20010037451A1 (en) * 2000-03-06 2001-11-01 Bhagavatula Ravishankar S. Centralized identity authentication for electronic communication networks
US6317838B1 (en) * 1998-04-29 2001-11-13 Bull S.A. Method and architecture to provide a secured remote access to private resources
WO2001086392A2 (en) * 2000-05-10 2001-11-15 The Procter & Gamble Company Method and apparatus for centralized authentication
US20010044893A1 (en) * 2000-01-07 2001-11-22 Tropic Networks Onc. Distributed subscriber management system
US20020035618A1 (en) * 2000-09-20 2002-03-21 Mendez Daniel J. System and method for transmitting workspace elements across a network
US6418466B1 (en) 1997-07-10 2002-07-09 International Business Machines Corporation Management of authentication discovery policy in a computer network
US20020091938A1 (en) * 1999-05-18 2002-07-11 Matti Hiltunen Method and device for authenticating locally-stored program code
GB2371957A (en) * 2000-10-23 2002-08-07 Motorola Inc Method of authenticating a network access server
US6438691B1 (en) * 1996-04-01 2002-08-20 Hewlett-Packard Company Transmitting messages over a network
US6442692B1 (en) 1998-07-21 2002-08-27 Arkady G. Zilberman Security method and apparatus employing authentication by keystroke dynamics
US6467040B1 (en) 1998-12-11 2002-10-15 International Business Machines Corporation Client authentication by server not known at request time
GB2374498A (en) * 2001-04-12 2002-10-16 Intercede Ltd Multi-stage authorisation system
US6487667B1 (en) * 1996-06-03 2002-11-26 Gary S. Brown System for remote pass-phrase authentication
US20020177433A1 (en) * 2001-05-24 2002-11-28 International Business Machines Corporation Methods and apparatus for restricting access of a user using a cellular telephone
US6493103B2 (en) * 1995-10-20 2002-12-10 Matsushita Graphic Communication Systems, Inc. Image communicating method, facsimile type electronic mail apparatus and facsimile apparatus
US20020188738A1 (en) * 1999-11-29 2002-12-12 Gray Robert H M Data networks
US20020194499A1 (en) * 2001-06-15 2002-12-19 Audebert Yves Louis Gabriel Method, system and apparatus for a portable transaction device
US20030018901A1 (en) * 2001-07-23 2003-01-23 Burritt David R. Method and apparatus for providing communications security using a remote server
AU757734B2 (en) * 1998-09-08 2003-03-06 Oracle International Corporation Method for handling data items of user-defined data types
US20030065956A1 (en) * 2001-09-28 2003-04-03 Abhijit Belapurkar Challenge-response data communication protocol
US20030105966A1 (en) * 2001-05-02 2003-06-05 Eric Pu Authentication server using multiple metrics for identity verification
US6594362B2 (en) * 1997-05-30 2003-07-15 Nec Corporation Radio data transmission apparatus
US20030144849A1 (en) * 2001-12-14 2003-07-31 Kakivaya Gopalakrishna Reddy System and method for generalized and distributed scalable eventing system
US20030149900A1 (en) * 2002-02-06 2003-08-07 Glassman Steven Charles System and method for providing multi-class processing of login requests
WO2003041360A3 (en) * 2001-11-02 2003-09-12 Neoteris Inc Method and system for providing secure access to resources on private networks
US20030177357A1 (en) * 2000-08-18 2003-09-18 Chamberlin Charles R. Apparatus and methods for the secure transfer of electronic data
US20030182568A1 (en) * 2002-03-21 2003-09-25 Snapp Robert F. Method and system for storing and retrieving data using hash-accessed multiple data stores
US20030187938A1 (en) * 1998-05-29 2003-10-02 Mousseau Gary P. System and method for pushing information from a host system to a mobile data communication device
US20030229718A1 (en) * 2002-06-06 2003-12-11 Neoteris, Inc. Method and system for providing secure access to private networks
US20030233584A1 (en) * 2002-06-14 2003-12-18 Microsoft Corporation Method and system using combinable computational puzzles as challenges to network entities for identity check
US20030233327A1 (en) * 2002-06-12 2003-12-18 Cardinal Commerce Corporation Universal merchant platform for payment authentication
US20030233554A1 (en) * 2000-04-09 2003-12-18 Assaf Litai Network content access control
FR2841070A1 (en) * 2002-06-17 2003-12-19 Cryptolog Interface system for the on-line exchange of contents data in a secure manner, used e.g. in electronic commerce etc., uses personal cryptographic data which is encoded to secure exchange of contents data
US20040003081A1 (en) * 2002-06-26 2004-01-01 Microsoft Corporation System and method for providing program credentials
US20040039827A1 (en) * 2001-11-02 2004-02-26 Neoteris, Inc. Method and system for providing secure access to private networks with client redirection
US20040049682A1 (en) * 2002-09-06 2004-03-11 Wilson James D. Method and system for efficiently retrieving secured data by securely pre-processing provided access information
US20040103323A1 (en) * 2002-11-21 2004-05-27 Honeywell International Inc. Generic security infrastructure for COM based systems
US20040122958A1 (en) * 2002-12-19 2004-06-24 International Business Machines Corporation Method and system for peer-to-peer authorization
US20040123152A1 (en) * 2002-12-18 2004-06-24 Eric Le Saint Uniform framework for security tokens
US20040139021A1 (en) * 2002-10-07 2004-07-15 Visa International Service Association Method and system for facilitating data access and management on a secure token
US20040139178A1 (en) * 1996-12-13 2004-07-15 Visto Corporation System and method for globally and securely accessing unified information in a computer network
US20040143730A1 (en) * 2001-06-15 2004-07-22 Wu Wen Universal secure messaging for remote security tokens
GB2399435A (en) * 2000-01-10 2004-09-15 Sun Microsystems Inc Using generic user name and password to generate a token to access a service.
WO2004093381A1 (en) * 2003-04-16 2004-10-28 Telefonaktiebolaget Lm Ericsson (Publ) Authentication method
EP1473618A2 (en) * 2003-04-29 2004-11-03 Activcard Inc. Uniform modular framework for a host computer system
US20040218762A1 (en) * 2003-04-29 2004-11-04 Eric Le Saint Universal secure messaging for cryptographic modules
US20040260946A1 (en) * 2003-06-20 2004-12-23 Cahill Conor P. User not present
US20050010758A1 (en) * 2001-08-10 2005-01-13 Peter Landrock Data certification method and apparatus
US20050018618A1 (en) * 2003-07-25 2005-01-27 Mualem Hezi I. System and method for threat detection and response
US20050060548A1 (en) * 2000-03-09 2005-03-17 Microsoft Corporation Session-state manager
US20050114705A1 (en) * 1997-12-11 2005-05-26 Eran Reshef Method and system for discriminating a human action from a computerized action
US20050123140A1 (en) * 2003-12-04 2005-06-09 Feghali Wajdi K. Technique for implementing a security algorithm
US20050138380A1 (en) * 2003-12-22 2005-06-23 Fedronic Dominique L.J. Entry control system
US20050136964A1 (en) * 2003-12-22 2005-06-23 Le Saint Eric F. Intelligent remote device
US20050144451A1 (en) * 2003-12-30 2005-06-30 Entrust Limited Method and apparatus for providing electronic message authentication
US20050144449A1 (en) * 2003-12-30 2005-06-30 Entrust Limited Method and apparatus for providing mutual authentication between a sending unit and a recipient
US20050149761A1 (en) * 2003-12-30 2005-07-07 Entrust Limited Method and apparatus for securely providing identification information using translucent identification member
US20050171737A1 (en) * 1998-06-15 2005-08-04 Hartley Bruce V. Method and apparatus for assessing the security of a computer system
US20050250473A1 (en) * 2004-05-04 2005-11-10 Research In Motion Limited Challenge response system and method
US20050283444A1 (en) * 2004-06-21 2005-12-22 Jan-Erik Ekberg Transaction & payment system securing remote authentication/validation of transactions from a transaction provider
US6981145B1 (en) * 1999-02-08 2005-12-27 Bull S.A. Device and process for remote authentication of a user
US20060015725A1 (en) * 2003-12-30 2006-01-19 Entrust Limited Offline methods for authentication in a client/server authentication system
US20060020575A1 (en) * 2002-03-21 2006-01-26 United States Postal Service Method and system for storing and retrieving data using hash-accessed multiple data stores
US20060026165A1 (en) * 2004-07-19 2006-02-02 Microsoft Corporation Remote file updates through remote protocol
US20060143434A1 (en) * 2000-08-21 2006-06-29 United States Postal Service Delivery point validation system
US20060156385A1 (en) * 2003-12-30 2006-07-13 Entrust Limited Method and apparatus for providing authentication using policy-controlled authentication articles and techniques
WO2006075917A2 (en) 2005-01-11 2006-07-20 Encap As Security code production method and methods of using the same, and programmable device therefor
US7085817B1 (en) 2000-09-26 2006-08-01 Juniper Networks, Inc. Method and system for modifying requests for remote resources
US20060195595A1 (en) * 2003-12-19 2006-08-31 Mendez Daniel J System and method for globally and securely accessing unified information in a computer network
US7111172B1 (en) * 1999-07-19 2006-09-19 Rsa Security Inc. System and methods for maintaining and distributing personal security devices
US20060242241A1 (en) * 2001-11-02 2006-10-26 Neoteris, Inc. Dual authentication of a requestor using a mail server and an authentication server
US7136896B1 (en) 2000-09-26 2006-11-14 Juniper Networks, Inc. Dynamic toolbar for markup language document
US20060271697A1 (en) * 2005-05-25 2006-11-30 Microsoft Corporation Data communication protocol
US20060276916A1 (en) * 2004-12-22 2006-12-07 Dearing Stephen M System and method for electronically processing address information
US20060288405A1 (en) * 2005-06-01 2006-12-21 At&T Corp. Authentication management platform for managed security service providers
US20070005967A1 (en) * 2003-12-30 2007-01-04 Entrust Limited Method and apparatus for providing authentication between a sending unit and a recipient based on challenge usage data
US20070015492A1 (en) * 2001-05-24 2007-01-18 International Business Machines Corporation Methods and apparatus for restricting access of a user using a cellular telephnoe
US7168088B1 (en) * 1995-11-02 2007-01-23 Sun Microsystems, Inc. Method and apparatus for reliable disk fencing in a multicomputer system
US20070094503A1 (en) * 2005-10-21 2007-04-26 Novell, Inc. Techniques for key distribution for use in encrypted communications
US20070101152A1 (en) * 2005-10-17 2007-05-03 Saflink Corporation Token authentication system
US7243853B1 (en) 2001-12-04 2007-07-17 Visa U.S.A. Inc. Method and system for facilitating memory and application management on a secured token
US7287271B1 (en) 1997-04-08 2007-10-23 Visto Corporation System and method for enabling secure access to services in a computer network
US20070250808A1 (en) * 1996-10-31 2007-10-25 Citicorp Development Center, Inc. Delivering financial services to remote devices
US7290278B2 (en) 2003-10-02 2007-10-30 Aol Llc, A Delaware Limited Liability Company Identity based service system
US7308709B1 (en) * 2000-04-21 2007-12-11 Microsoft Corporation System and method for managing and authenticating services via service principal names
US20080010673A1 (en) * 2006-07-07 2008-01-10 Fujitsu Limited System, apparatus, and method for user authentication
US7325065B1 (en) * 2001-12-21 2008-01-29 Aol Llc, A Delaware Limited Liability Company Identifying unauthorized communication systems using a system-specific identifier
US20080040613A1 (en) * 2006-08-14 2008-02-14 David Carroll Challener Apparatus, system, and method for secure password reset
US20080046740A1 (en) * 2006-07-26 2008-02-21 Matsushita Electric Industrial Co. Ltd Authentication of a peer in a peer-to-peer network
US7350078B1 (en) * 2001-04-26 2008-03-25 Gary Odom User selection of computer login
US20080098222A1 (en) * 2004-09-22 2008-04-24 Zilberman Arkady G Device with built-in user authentication and method for user authentication and identity theft protection
US7373517B1 (en) * 1999-08-19 2008-05-13 Visto Corporation System and method for encrypting and decrypting files
WO2008070638A2 (en) * 2006-12-04 2008-06-12 Magtek Inc. Encrypting the output of a card reader in a card authentication system
US20080162687A1 (en) * 2006-12-28 2008-07-03 David Alan Scott Data acquisition system and method
US20080161114A1 (en) * 2005-09-10 2008-07-03 Tencent Technology (Shenzhen) Company Limited Method, System and Apparatus for Game Data Transmission
US20080165970A1 (en) * 2007-01-05 2008-07-10 Chung Hyen V runtime mechanism for flexible messaging security protocols
US7401114B1 (en) * 1998-04-20 2008-07-15 Sun Microsystems, Inc. Method and apparatus for making a computational service highly available
US20080181408A1 (en) * 2001-03-29 2008-07-31 Arcot Systems, Inc. Method And Apparatus For Secure Cryptographic Key Generation, Certification And Use
US20080276308A1 (en) * 2005-11-24 2008-11-06 Thomas Graser Single Sign On
US20080295169A1 (en) * 2007-05-25 2008-11-27 Crume Jeffery L Detecting and defending against man-in-the-middle attacks
WO2007035846A3 (en) * 2005-09-21 2008-11-27 Rsa Security Inc Authentication method and apparatus utilizing proof-of-authentication module
US7529778B1 (en) 2001-12-12 2009-05-05 Microsoft Corporation System and method for providing access to consistent point-in-time file versions
US20090119205A1 (en) * 1999-10-01 2009-05-07 Cardinalcommerce Corporation Secure and efficient payment processing system
US20090119475A1 (en) * 2007-11-01 2009-05-07 Microsoft Corporation Time based priority modulus for security challenges
US20090313147A1 (en) * 2008-06-03 2009-12-17 Balasubramanian Chandra S Alternative payment implementation for electronic retailers
CN1663171B (en) * 2002-05-15 2010-05-05 高通股份有限公司 System and method for using acoustic digital signature generator as oracle
US7743247B1 (en) * 1997-08-08 2010-06-22 Synectic Design LLC Method and apparatus for secure communications
US20100169215A1 (en) * 2002-06-12 2010-07-01 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US20100180328A1 (en) * 2007-06-26 2010-07-15 Marks & Clerk, Llp Authentication system and method
US20100189251A1 (en) * 2009-01-23 2010-07-29 Edward Curren Security Enhanced Data Platform
US7774455B1 (en) 2000-09-26 2010-08-10 Juniper Networks, Inc. Method and system for providing secure access to private networks
US20100269162A1 (en) * 2009-04-15 2010-10-21 Jose Bravo Website authentication
US20100299731A1 (en) * 2006-03-08 2010-11-25 Steven Paul Atkinson Electronic System for Securing Electronic Services
US20100313037A1 (en) * 2009-06-04 2010-12-09 Ward Rory A Collectible case authentication system, device and method
US20100332832A1 (en) * 2009-06-26 2010-12-30 Institute For Information Industry Two-factor authentication method and system for securing online transactions
US7865569B1 (en) 2000-09-26 2011-01-04 Juniper Networks, Inc. Method and system for modifying script portions of requests for remote resources
US20110131415A1 (en) * 2009-11-30 2011-06-02 James Paul Schneider Multifactor username based authentication
US20110138483A1 (en) * 2009-12-04 2011-06-09 International Business Machines Corporation Mobile phone and ip address correlation service
US20110167002A1 (en) * 2002-06-12 2011-07-07 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US8042172B1 (en) * 2006-02-02 2011-10-18 Emc Corporation Remote access architecture enabling a client to perform an operation
US20110296170A1 (en) * 2010-05-31 2011-12-01 Intercity Business Corporation Tolerant key verification method
US20110293098A1 (en) * 2010-05-28 2011-12-01 Christina Fu Key recovery mechanism
US8165909B2 (en) 2005-05-17 2012-04-24 The United States Postal Service System and method for automated management of an address database
US8190513B2 (en) 1996-06-05 2012-05-29 Fraud Control Systems.Com Corporation Method of billing a purchase made over a computer network
US8229844B2 (en) 1996-06-05 2012-07-24 Fraud Control Systems.Com Corporation Method of billing a purchase made over a computer network
US8230026B2 (en) 2002-06-26 2012-07-24 Research In Motion Limited System and method for pushing information between a host system and a mobile data communication device
US20120216046A1 (en) * 2011-02-22 2012-08-23 Raytheon Company System and Method for Decrypting Files
US20120260093A1 (en) * 2003-10-27 2012-10-11 Jp Morgan Chase Bank Portable Security Transaction Protocol
US8341127B1 (en) * 2006-02-02 2012-12-25 Emc Corporation Client initiated restore
US20130024918A1 (en) * 2011-07-20 2013-01-24 Jason Scott Cramer Methods and systems for authenticating users over networks
US20130042314A1 (en) * 2011-08-11 2013-02-14 Bank Of America Corporation System and Method for Authenticating a User
US20130097427A1 (en) * 2011-10-12 2013-04-18 Goldkey Security Corporation Soft-Token Authentication System
US20130185781A1 (en) * 2012-01-16 2013-07-18 Sangfor Networks Company Limited Method and device for realizing remote login
US8533123B2 (en) 2010-12-13 2013-09-10 Magtek, Inc. Systems and methods for conducting contactless payments using a mobile device and a magstripe payment card
US8631277B2 (en) 2010-12-10 2014-01-14 Microsoft Corporation Providing transparent failover in a file system
US8630942B2 (en) 1996-06-05 2014-01-14 Fraud Control Systems.Com Corporation Method of billing a purchase made over a computer network
US8762210B2 (en) 2008-06-03 2014-06-24 Cardinalcommerce Corporation Alternative payment implementation for electronic retailers
US8788579B2 (en) 2011-09-09 2014-07-22 Microsoft Corporation Clustered client failover
US8838988B2 (en) 2011-04-12 2014-09-16 International Business Machines Corporation Verification of transactional integrity
US8850200B1 (en) 2011-06-21 2014-09-30 Synectic Design, LLC Method and apparatus for secure communications through a trusted intermediary server
US8856582B2 (en) 2011-06-30 2014-10-07 Microsoft Corporation Transparent failover
US8886902B1 (en) 2006-02-02 2014-11-11 Emc Corporation Disk backup set access
US8917826B2 (en) 2012-07-31 2014-12-23 International Business Machines Corporation Detecting man-in-the-middle attacks in electronic transactions using prompts
US9021248B2 (en) * 2013-08-22 2015-04-28 SolidMobile, Inc. Secure access of mobile devices using passwords
US9203620B1 (en) 2008-01-28 2015-12-01 Emc Corporation System, method and apparatus for secure use of cryptographic credentials in mobile devices
US9213968B2 (en) 2010-12-13 2015-12-15 Magtek, Inc. Systems and methods for conducting financial transactions using non-standard magstripe payment cards
US9258113B2 (en) 2008-08-29 2016-02-09 Red Hat, Inc. Username based key exchange
US9298793B2 (en) 1998-05-29 2016-03-29 Blackberry Limited System and method for pushing information from a host system to a mobile data communication device
US20160117494A1 (en) * 2014-10-24 2016-04-28 International Business Machines Corporation Keyboard neutral authentication
US9331955B2 (en) 2011-06-29 2016-05-03 Microsoft Technology Licensing, Llc Transporting operations of arbitrary size over remote direct memory access
US9754101B2 (en) 2011-06-01 2017-09-05 Paypal, Inc. Password check by decomposing password
US20180097818A1 (en) * 2016-10-03 2018-04-05 Extreme Networks, Inc. Enhanced access security gateway
US9961053B2 (en) * 2016-05-27 2018-05-01 Dropbox, Inc. Detecting compromised credentials
US10007908B1 (en) 1996-10-30 2018-06-26 Citicorp Credit Services, Inc. (Usa) Method and system for automatically harmonizing access to a software application program via different access devices
US10277623B2 (en) * 2016-03-18 2019-04-30 AppBugs, INC. Method of detection of comptromised accounts
WO2019216950A1 (en) * 2018-05-08 2019-11-14 Visa International Service Association Password based threshold token generation
US10574463B2 (en) * 2015-02-06 2020-02-25 eStorm Co., LTD Authentication method and system
US10630781B2 (en) 2011-09-09 2020-04-21 Microsoft Technology Licensing, Llc SMB2 scaleout
US11195173B2 (en) 2016-07-15 2021-12-07 Cardinalcommerce Corporation Authentication to authorization bridge using enriched messages
US11895240B2 (en) * 2016-12-15 2024-02-06 Nec Corporation System, apparatus, method and program for preventing illegal distribution of an access token

Citations (42)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3798605A (en) * 1971-06-30 1974-03-19 Ibm Centralized verification system
US3996449A (en) * 1975-08-25 1976-12-07 International Business Machines Corporation Operating system authenticator
US4218738A (en) * 1978-05-05 1980-08-19 International Business Machines Corporation Method for authenticating the identity of a user of an information system
US4227253A (en) * 1977-12-05 1980-10-07 International Business Machines Corporation Cryptographic communication security for multiple domain networks
US4264782A (en) * 1979-06-29 1981-04-28 International Business Machines Corporation Method and apparatus for transaction and identity verification
US4288659A (en) * 1979-05-21 1981-09-08 Atalla Technovations Method and means for securing the distribution of encoding keys
US4386266A (en) * 1980-02-11 1983-05-31 International Business Machines Corporation Method for operating a transaction execution system having improved verification of personal identification
US4399323A (en) * 1981-02-09 1983-08-16 Bell Telephone Laboratories, Incorporated Fast real-time public key cryptography
US4430728A (en) * 1981-12-29 1984-02-07 Marathon Oil Company Computer terminal security system
US4626845A (en) * 1983-02-28 1986-12-02 Epic Systems, Inc. Subscriber validation system
US4661991A (en) * 1984-03-10 1987-04-28 U.S. Philips Corporation Circuit arrangement for preventing unauthorized access to a communication system which is protected by a subscriber-specific password
US4736423A (en) * 1985-04-30 1988-04-05 International Business Machines Corporation Technique for reducing RSA Crypto variable storage
US4755940A (en) * 1983-09-17 1988-07-05 International Business Machines Corporation Transaction security system
US4799061A (en) * 1985-11-18 1989-01-17 International Business Machines Corporation Secure component authentication system
US4815031A (en) * 1985-09-02 1989-03-21 Nec Corporation Method for granting a request to authorized data terminal users accessing from any locations
US4868877A (en) * 1988-02-12 1989-09-19 Fischer Addison M Public key/signature cryptosystem with enhanced digital signature certification
US4881264A (en) * 1987-07-30 1989-11-14 Merkle Ralph C Digital signature system and method based on a conventional encryption function
US4910773A (en) * 1987-04-03 1990-03-20 Cii Honeywell Bull (Societe Anonyme) Method of dispatching secret keys to security modules and user cards in a data processing network
US4919545A (en) * 1988-12-22 1990-04-24 Gte Laboratories Incorporated Distributed security procedure for intelligent networks
US4924515A (en) * 1988-08-29 1990-05-08 International Business Machines Coprporation Secure management of keys using extended control vectors
US4932056A (en) * 1989-03-16 1990-06-05 Yeda Research And Development Company Limited Method and apparatus for user identification based on permuted kernels
US4965568A (en) * 1989-03-01 1990-10-23 Atalla Martin M Multilevel security apparatus and method with personal key
US4974193A (en) * 1987-03-04 1990-11-27 Siemens Aktiengesellschaft Circuit arrangement for protecting access to a data processing system with the assistance of a chip card
US4993068A (en) * 1989-11-27 1991-02-12 Motorola, Inc. Unforgeable personal identification system
US5023908A (en) * 1984-11-30 1991-06-11 Kenneth Weiss Method and apparatus for personal identification
US5029208A (en) * 1989-03-03 1991-07-02 Nec Corporation Cipher-key distribution system
US5050212A (en) * 1990-06-20 1991-09-17 Apple Computer, Inc. Method and apparatus for verifying the integrity of a file stored separately from a computer
US5068894A (en) * 1989-08-22 1991-11-26 U.S. Philips Corp. Method of generating a unique number for a smart card and its use for the cooperation of the card with a host system
US5081678A (en) * 1989-06-28 1992-01-14 Digital Equipment Corporation Method for utilizing an encrypted key as a key identifier in a data packet in a computer network
US5109152A (en) * 1988-07-13 1992-04-28 Matsushita Electric Industrial Co., Ltd. Communication apparatus
US5136647A (en) * 1990-08-02 1992-08-04 Bell Communications Research, Inc. Method for secure time-stamping of digital documents
US5136646A (en) * 1991-03-08 1992-08-04 Bell Communications Research, Inc. Digital document time-stamping with catenate certificate
US5146499A (en) * 1989-10-27 1992-09-08 U.S. Philips Corporation Data processing system comprising authentification means viz a viz a smart card, an electronic circuit for use in such system, and a procedure for implementing such authentification
US5148479A (en) * 1991-03-20 1992-09-15 International Business Machines Corp. Authentication protocols in communication networks
US5163096A (en) * 1991-06-06 1992-11-10 International Business Machines Corporation Storage protection utilizing public storage key control
US5201000A (en) * 1991-09-27 1993-04-06 International Business Machines Corporation Method for generating public and private key pairs without using a passphrase
US5204966A (en) * 1990-03-09 1993-04-20 Digital Equipment Corporation System for controlling access to a secure system by verifying acceptability of proposed password by using hashing and group of unacceptable passwords
US5220604A (en) * 1990-09-28 1993-06-15 Digital Equipment Corporation Method for performing group exclusion in hierarchical group structures
US5224163A (en) * 1990-09-28 1993-06-29 Digital Equipment Corporation Method for delegating authorization from one entity to another through the use of session encryption keys
US5235644A (en) * 1990-06-29 1993-08-10 Digital Equipment Corporation Probabilistic cryptographic processing method
US5297206A (en) * 1992-03-19 1994-03-22 Orton Glenn A Cryptographic method for communication and electronic signatures
US5315658A (en) * 1992-04-20 1994-05-24 Silvio Micali Fair cryptosystems and methods of use

Patent Citations (43)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3798605A (en) * 1971-06-30 1974-03-19 Ibm Centralized verification system
US3996449A (en) * 1975-08-25 1976-12-07 International Business Machines Corporation Operating system authenticator
US4227253A (en) * 1977-12-05 1980-10-07 International Business Machines Corporation Cryptographic communication security for multiple domain networks
US4218738A (en) * 1978-05-05 1980-08-19 International Business Machines Corporation Method for authenticating the identity of a user of an information system
US4288659A (en) * 1979-05-21 1981-09-08 Atalla Technovations Method and means for securing the distribution of encoding keys
US4264782A (en) * 1979-06-29 1981-04-28 International Business Machines Corporation Method and apparatus for transaction and identity verification
US4386266A (en) * 1980-02-11 1983-05-31 International Business Machines Corporation Method for operating a transaction execution system having improved verification of personal identification
US4399323A (en) * 1981-02-09 1983-08-16 Bell Telephone Laboratories, Incorporated Fast real-time public key cryptography
US4430728A (en) * 1981-12-29 1984-02-07 Marathon Oil Company Computer terminal security system
US4626845A (en) * 1983-02-28 1986-12-02 Epic Systems, Inc. Subscriber validation system
US4755940A (en) * 1983-09-17 1988-07-05 International Business Machines Corporation Transaction security system
US4661991A (en) * 1984-03-10 1987-04-28 U.S. Philips Corporation Circuit arrangement for preventing unauthorized access to a communication system which is protected by a subscriber-specific password
US5023908A (en) * 1984-11-30 1991-06-11 Kenneth Weiss Method and apparatus for personal identification
US4736423A (en) * 1985-04-30 1988-04-05 International Business Machines Corporation Technique for reducing RSA Crypto variable storage
US4815031A (en) * 1985-09-02 1989-03-21 Nec Corporation Method for granting a request to authorized data terminal users accessing from any locations
US4799061A (en) * 1985-11-18 1989-01-17 International Business Machines Corporation Secure component authentication system
US4974193A (en) * 1987-03-04 1990-11-27 Siemens Aktiengesellschaft Circuit arrangement for protecting access to a data processing system with the assistance of a chip card
US4910773A (en) * 1987-04-03 1990-03-20 Cii Honeywell Bull (Societe Anonyme) Method of dispatching secret keys to security modules and user cards in a data processing network
US4881264A (en) * 1987-07-30 1989-11-14 Merkle Ralph C Digital signature system and method based on a conventional encryption function
US4868877A (en) * 1988-02-12 1989-09-19 Fischer Addison M Public key/signature cryptosystem with enhanced digital signature certification
US5109152A (en) * 1988-07-13 1992-04-28 Matsushita Electric Industrial Co., Ltd. Communication apparatus
US4924515A (en) * 1988-08-29 1990-05-08 International Business Machines Coprporation Secure management of keys using extended control vectors
US4919545A (en) * 1988-12-22 1990-04-24 Gte Laboratories Incorporated Distributed security procedure for intelligent networks
US4965568A (en) * 1989-03-01 1990-10-23 Atalla Martin M Multilevel security apparatus and method with personal key
US5029208A (en) * 1989-03-03 1991-07-02 Nec Corporation Cipher-key distribution system
US4932056A (en) * 1989-03-16 1990-06-05 Yeda Research And Development Company Limited Method and apparatus for user identification based on permuted kernels
US5081678A (en) * 1989-06-28 1992-01-14 Digital Equipment Corporation Method for utilizing an encrypted key as a key identifier in a data packet in a computer network
US5068894A (en) * 1989-08-22 1991-11-26 U.S. Philips Corp. Method of generating a unique number for a smart card and its use for the cooperation of the card with a host system
US5146499A (en) * 1989-10-27 1992-09-08 U.S. Philips Corporation Data processing system comprising authentification means viz a viz a smart card, an electronic circuit for use in such system, and a procedure for implementing such authentification
US4993068A (en) * 1989-11-27 1991-02-12 Motorola, Inc. Unforgeable personal identification system
US5204966A (en) * 1990-03-09 1993-04-20 Digital Equipment Corporation System for controlling access to a secure system by verifying acceptability of proposed password by using hashing and group of unacceptable passwords
US5050212A (en) * 1990-06-20 1991-09-17 Apple Computer, Inc. Method and apparatus for verifying the integrity of a file stored separately from a computer
US5235644A (en) * 1990-06-29 1993-08-10 Digital Equipment Corporation Probabilistic cryptographic processing method
US5136647A (en) * 1990-08-02 1992-08-04 Bell Communications Research, Inc. Method for secure time-stamping of digital documents
US5224163A (en) * 1990-09-28 1993-06-29 Digital Equipment Corporation Method for delegating authorization from one entity to another through the use of session encryption keys
US5220604A (en) * 1990-09-28 1993-06-15 Digital Equipment Corporation Method for performing group exclusion in hierarchical group structures
US5136646A (en) * 1991-03-08 1992-08-04 Bell Communications Research, Inc. Digital document time-stamping with catenate certificate
US5148479A (en) * 1991-03-20 1992-09-15 International Business Machines Corp. Authentication protocols in communication networks
US5163096A (en) * 1991-06-06 1992-11-10 International Business Machines Corporation Storage protection utilizing public storage key control
US5201000A (en) * 1991-09-27 1993-04-06 International Business Machines Corporation Method for generating public and private key pairs without using a passphrase
US5297206A (en) * 1992-03-19 1994-03-22 Orton Glenn A Cryptographic method for communication and electronic signatures
US5315658A (en) * 1992-04-20 1994-05-24 Silvio Micali Fair cryptosystems and methods of use
US5315658B1 (en) * 1992-04-20 1995-09-12 Silvio Micali Fair cryptosystems and methods of use

Non-Patent Citations (11)

* Cited by examiner, † Cited by third party
Title
1989, Mark, T., et al, Reducing Risks from Poorly Chosen Keys, University of Cambridge Computer Laboratory, from 12th Symposium On Operating System Principles. *
Abadi et al., "Authentication and Delegation with Smart-Cards," Oct. 22, 1990, pp. 1-24, place of publication unknown.
Abadi et al., Authentication and Delegation with Smart Cards, Oct. 22, 1990, pp. 1 24, place of publication unknown. *
Lomas et al., "Reducing Risks from Poorly Chosen Keys," 12th Symposium on Operating System Principles, 1989, pp. 14-18, place of pub. unknown.
Lomas et al., Reducing Risks from Poorly Chosen Keys, 12th Symposium on Operating System Principles, 1989, pp. 14 18, place of pub. unknown. *
Security Dynamics, Inc., Kerberos and SecurID, approximately Apr. 1992, not published. *
Tardo et al., "SPX: Global Authentication Using Public Key Certificates," Proceedings of IEEE Symposium Research in Security and Privacy, IEEE CS Press, 1991, pp. 232-244, place of publication unknown.
Tardo et al., SPX: Global Authentication Using Public Key Certificates, Proceedings of IEEE Symposium Research in Security and Privacy, IEEE CS Press, 1991, pp. 232 244, place of publication unknown. *
U.S. application Ser. No. 07/875,050, filed Apr. 28, 1992, Kaufman et al. *
Woo et al., "Authentication for Distributed Systems," from Computer of IEEE Computer Society, Jan. 1992, pp. 49-51, place of pub. unknown.
Woo et al., Authentication for Distributed Systems, from Computer of IEEE Computer Society, Jan. 1992, pp. 49 51, place of pub. unknown. *

Cited By (419)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5680470A (en) 1993-12-17 1997-10-21 Moussa; Ali Mohammed Method of automated signature verification
US6081898A (en) * 1993-12-29 2000-06-27 Microsoft Corporation Unification of directory service with file system service
US5841866A (en) * 1994-09-30 1998-11-24 Microchip Technology Incorporated Secure token integrated circuit and method of performing a secure authentication function or transaction
US5815574A (en) * 1994-12-15 1998-09-29 International Business Machines Corporation Provision of secure access to external resources from a distributed computing environment
US5706349A (en) * 1995-03-06 1998-01-06 International Business Machines Corporation Authenticating remote users in a distributed environment
US5661803A (en) * 1995-03-31 1997-08-26 Pitney Bowes Inc. Method of token verification in a key management system
US5864667A (en) * 1995-04-05 1999-01-26 Diversinet Corp. Method for safe communications
US6119227A (en) * 1995-04-18 2000-09-12 Hewlett-Packard Company Methods and apparatus for authenticating an originator of a message
US5737422A (en) * 1995-04-26 1998-04-07 Billings; Roger E. Distributed data processing network
US5781725A (en) * 1995-05-23 1998-07-14 Nec Corporation Computer network system having a small of amount of data in a network
US5872917A (en) * 1995-06-07 1999-02-16 America Online, Inc. Authentication using random challenges
US5742759A (en) * 1995-08-18 1998-04-21 Sun Microsystems, Inc. Method and system for facilitating access control to system resources in a distributed computer system
US5841970A (en) * 1995-09-08 1998-11-24 Cadix, Inc. Authentication method for networks
US5706427A (en) * 1995-09-08 1998-01-06 Cadix Inc. Authentication method for networks
US6493103B2 (en) * 1995-10-20 2002-12-10 Matsushita Graphic Communication Systems, Inc. Image communicating method, facsimile type electronic mail apparatus and facsimile apparatus
US6906820B2 (en) 1995-10-20 2005-06-14 Panasonic Communications Co., Ltd. Image communicating method, facsimile type electronic mail apparatus and facsimile apparatus
US6937359B2 (en) 1995-10-20 2005-08-30 Panasonic Communications Co., Ltd. Image communicating method, facsimile type electronic mail apparatus and facsimile apparatus
US20030016397A1 (en) * 1995-10-20 2003-01-23 Matsushita Graphic Communication Systems, Inc. Image communicating method, facsimile type electronic mail apparatus and facsimile apparatus
US7168088B1 (en) * 1995-11-02 2007-01-23 Sun Microsystems, Inc. Method and apparatus for reliable disk fencing in a multicomputer system
US5838903A (en) * 1995-11-13 1998-11-17 International Business Machines Corporation Configurable password integrity servers for use in a shared resource environment
US5720034A (en) * 1995-12-07 1998-02-17 Case; Jeffrey D. Method for secure key production
US5764887A (en) * 1995-12-11 1998-06-09 International Business Machines Corporation System and method for supporting distributed computing mechanisms in a local area network server environment
US5664099A (en) * 1995-12-28 1997-09-02 Lotus Development Corporation Method and apparatus for establishing a protected channel between a user and a computer system
US20040103322A1 (en) * 1996-02-06 2004-05-27 Wesinger Ralph E. Firewall providing enhanced network security and user transparency
US5826014A (en) * 1996-02-06 1998-10-20 Network Engineering Software Firewall system for protecting network elements connected to a public network
US20060112424A1 (en) * 1996-02-06 2006-05-25 Christopher Coley Method for authenticating a user access request
US20050229248A1 (en) * 1996-02-06 2005-10-13 Coley Christopher D Method for transparently managing outbound traffic from an internal user of a private network destined for a public network
US6061798A (en) * 1996-02-06 2000-05-09 Network Engineering Software, Inc. Firewall system for protecting network elements connected to a public network
US7383573B2 (en) 1996-02-06 2008-06-03 Graphon Corporation Method for transparently managing outbound traffic from an internal user of a private network destined for a public network
US20050235359A1 (en) * 1996-02-06 2005-10-20 Coley Christopher D Method for resisting a denial-of-service attack of a private network element
US20050235348A1 (en) * 1996-02-06 2005-10-20 Coley Christopher D System for preventing unwanted access to information on a computer
US6438691B1 (en) * 1996-04-01 2002-08-20 Hewlett-Packard Company Transmitting messages over a network
US5956409A (en) 1996-04-29 1999-09-21 Quintet, Inc. Secure application of seals
US6487667B1 (en) * 1996-06-03 2002-11-26 Gary S. Brown System for remote pass-phrase authentication
US8630942B2 (en) 1996-06-05 2014-01-14 Fraud Control Systems.Com Corporation Method of billing a purchase made over a computer network
US8229844B2 (en) 1996-06-05 2012-07-24 Fraud Control Systems.Com Corporation Method of billing a purchase made over a computer network
US8190513B2 (en) 1996-06-05 2012-05-29 Fraud Control Systems.Com Corporation Method of billing a purchase made over a computer network
US5943424A (en) * 1996-06-17 1999-08-24 Hewlett-Packard Company System, method and article of manufacture for processing a plurality of transactions from a single initiation point on a multichannel, extensible, flexible architecture
US6240396B1 (en) 1996-09-04 2001-05-29 Priceline.Com Incorporated Conditional purchase offer management system for event tickets
US5892902A (en) * 1996-09-05 1999-04-06 Clark; Paul C. Intelligent token protected system with network authentication
US5684950A (en) * 1996-09-23 1997-11-04 Lockheed Martin Corporation Method and system for authenticating users to multiple computer servers via a single sign-on
US20070101421A1 (en) * 1996-10-17 2007-05-03 Graphon Corporation Virtual private network
US20060053486A1 (en) * 1996-10-17 2006-03-09 Graphon Nes Sub, Llc. Method for providing a virtual private network connection
US7424737B2 (en) 1996-10-17 2008-09-09 Graphon Corporation Virtual host for protocol transforming traffic traversing between an IP-compliant source and non-IP compliant destination
US6804783B1 (en) 1996-10-17 2004-10-12 Network Engineering Software Firewall providing enhanced network security and user transparency
US20050022030A1 (en) * 1996-10-17 2005-01-27 Wesinger Ralph E. Virtual host for channel processing traffic traversing between a source and destination
US20060288408A1 (en) * 1996-10-17 2006-12-21 Graphon Corporation Virtual private network
US5898830A (en) * 1996-10-17 1999-04-27 Network Engineering Software Firewall providing enhanced network security and user transparency
US5892828A (en) * 1996-10-23 1999-04-06 Novell, Inc. User presence verification with single password across applications
US10007908B1 (en) 1996-10-30 2018-06-26 Citicorp Credit Services, Inc. (Usa) Method and system for automatically harmonizing access to a software application program via different access devices
US10013680B1 (en) 1996-10-30 2018-07-03 Citicorp Credit Services, Inc. (Usa) Method and system for automatically harmonizing access to a software application program via different access devices
US9129279B1 (en) 1996-10-30 2015-09-08 Citicorp Credit Services, Inc. (Usa) Delivering financial services to remote devices
US8543982B2 (en) * 1996-10-31 2013-09-24 Citicorp Development Center, Inc. Delivering financial services to remote devices
US20070250808A1 (en) * 1996-10-31 2007-10-25 Citicorp Development Center, Inc. Delivering financial services to remote devices
WO1998025375A1 (en) * 1996-12-04 1998-06-11 V-One Corporation Token distribution and registration system and method
US5784463A (en) * 1996-12-04 1998-07-21 V-One Corporation Token distribution, registration, and dynamic configuration of user entitlement for an application level security system and method
US20090307362A1 (en) * 1996-12-13 2009-12-10 Visto Corporation System and method for globally and securely accessing unified information in a computer network
US20100005125A1 (en) * 1996-12-13 2010-01-07 Visto Corporation System and method for globally and securely accessing unified information in a computer network
US20100005195A1 (en) * 1996-12-13 2010-01-07 Visto Corporation System and method for globally and securely accessing unified information in a computer network
US20040139178A1 (en) * 1996-12-13 2004-07-15 Visto Corporation System and method for globally and securely accessing unified information in a computer network
US9361603B2 (en) 1996-12-13 2016-06-07 Good Technology Corporation System and method for globally and securely accessing unified information in a computer network
US20110153779A1 (en) * 1996-12-13 2011-06-23 Visto Corporation System and method for globally and securely accessing unified information in a computer network
US7039679B2 (en) 1996-12-13 2006-05-02 Visto Corporation System and method for globally and securely accessing unified information in a computer network
US8117344B2 (en) 1996-12-13 2012-02-14 Visto Corporation Global server for authenticating access to remote services
US8812702B2 (en) 1996-12-13 2014-08-19 Good Technology Corporation System and method for globally and securely accessing unified information in a computer network
US8745167B2 (en) 1996-12-13 2014-06-03 Good Technology Corporation System and method for globally and securely accessing unified information in a computer network
US5875296A (en) * 1997-01-28 1999-02-23 International Business Machines Corporation Distributed file system web server user authentication with cookies
US5812764A (en) * 1997-01-30 1998-09-22 International Business Machines Password management system over a communications network
US6035406A (en) * 1997-04-02 2000-03-07 Quintet, Inc. Plurality-factor security system
US6766454B1 (en) * 1997-04-08 2004-07-20 Visto Corporation System and method for using an authentication applet to identify and authenticate a user in a computer network
US7287271B1 (en) 1997-04-08 2007-10-23 Visto Corporation System and method for enabling secure access to services in a computer network
US6134597A (en) * 1997-05-28 2000-10-17 International Business Machines Corporation CRC hash compressed server object identifier
US6148404A (en) * 1997-05-28 2000-11-14 Nihon Unisys, Ltd. Authentication system using authentication information valid one-time
US6594362B2 (en) * 1997-05-30 2003-07-15 Nec Corporation Radio data transmission apparatus
US6079021A (en) * 1997-06-02 2000-06-20 Digital Equipment Corporation Method and apparatus for strengthening passwords for protection of computer systems
US6021496A (en) * 1997-07-07 2000-02-01 International Business Machines Corporation User authentication from non-native server domains in a computer network
US6418466B1 (en) 1997-07-10 2002-07-09 International Business Machines Corporation Management of authentication discovery policy in a computer network
US6141758A (en) * 1997-07-14 2000-10-31 International Business Machines Corporation Method and system for maintaining client server security associations in a distributed computing system
WO1999005813A3 (en) * 1997-07-23 2000-01-20 Visto Corp User authentication applet in a computer network
WO1999005813A2 (en) * 1997-07-23 1999-02-04 Visto Corporation User authentication applet in a computer network
US7743247B1 (en) * 1997-08-08 2010-06-22 Synectic Design LLC Method and apparatus for secure communications
US8060742B2 (en) 1997-08-08 2011-11-15 Synectic Design, LLC Method and apparatus for secure communications
US20100275011A1 (en) * 1997-08-08 2010-10-28 Synectic Design LLC Method and apparatus for secure communications
US6107932A (en) * 1997-08-22 2000-08-22 Walker Digital, Llc System and method for controlling access to a venue using alterable tickets
US6064736A (en) * 1997-09-15 2000-05-16 International Business Machines Corporation Systems, methods and computer program products that use an encrypted session for additional password verification
US20050114705A1 (en) * 1997-12-11 2005-05-26 Eran Reshef Method and system for discriminating a human action from a computerized action
US20090138944A1 (en) * 1997-12-23 2009-05-28 Arcot Systems, Inc. Method and apparatus for camouflaging of data, information and functional transformations
US8429720B2 (en) * 1997-12-23 2013-04-23 Ca, Inc. Method and apparatus for camouflaging of data, information and functional transformations
US6263446B1 (en) * 1997-12-23 2001-07-17 Arcot Systems, Inc. Method and apparatus for secure distribution of authentication credentials to roaming users
WO2000030285A1 (en) * 1997-12-23 2000-05-25 Arcot Systems, Inc. Method and apparatus for secure distribution of authentication credentials to roaming users
US7401114B1 (en) * 1998-04-20 2008-07-15 Sun Microsystems, Inc. Method and apparatus for making a computational service highly available
US6317838B1 (en) * 1998-04-29 2001-11-13 Bull S.A. Method and architecture to provide a secured remote access to private resources
US6233341B1 (en) 1998-05-19 2001-05-15 Visto Corporation System and method for installing and using a temporary certificate at a remote site
US9298793B2 (en) 1998-05-29 2016-03-29 Blackberry Limited System and method for pushing information from a host system to a mobile data communication device
US7386588B2 (en) 1998-05-29 2008-06-10 Research In Motion Limited System and method for pushing information from a host system to a mobile data communication device
US7509376B2 (en) 1998-05-29 2009-03-24 Research In Motion Limited System and method for redirecting message attachments between a host system and a mobile data communication device
US20030187938A1 (en) * 1998-05-29 2003-10-02 Mousseau Gary P. System and method for pushing information from a host system to a mobile data communication device
US20050171737A1 (en) * 1998-06-15 2005-08-04 Hartley Bruce V. Method and apparatus for assessing the security of a computer system
US6442692B1 (en) 1998-07-21 2002-08-27 Arkady G. Zilberman Security method and apparatus employing authentication by keystroke dynamics
WO2000007326A1 (en) * 1998-07-31 2000-02-10 Sun Microsystems, Inc. Methods and systems for establishing a shared secret using an authentication token
US6173400B1 (en) * 1998-07-31 2001-01-09 Sun Microsystems, Inc. Methods and systems for establishing a shared secret using an authentication token
AU757734B2 (en) * 1998-09-08 2003-03-06 Oracle International Corporation Method for handling data items of user-defined data types
EP1131911A4 (en) * 1998-11-19 2005-08-10 Arcot Systems Inc Method and apparatus for secure distribution of authentication credentials to roaming users
EP1131911A1 (en) * 1998-11-19 2001-09-12 Arcot Systems, Inc. Method and apparatus for secure distribution of authentication credentials to roaming users
CN1303778C (en) * 1998-11-19 2007-03-07 阿科特系统公司 Method and apparatus for secure distribution of authentication credentials to roaming users
JP2002530930A (en) * 1998-11-19 2002-09-17 アルコット システムズ インコーポレイテッド Method and apparatus for securely distributing authentication credentials to roaming users
US6467040B1 (en) 1998-12-11 2002-10-15 International Business Machines Corporation Client authentication by server not known at request time
US6981145B1 (en) * 1999-02-08 2005-12-27 Bull S.A. Device and process for remote authentication of a user
US7000117B2 (en) * 1999-05-18 2006-02-14 Sonera Smarttrust Oy Method and device for authenticating locally-stored program code
US20020091938A1 (en) * 1999-05-18 2002-07-11 Matti Hiltunen Method and device for authenticating locally-stored program code
US7111172B1 (en) * 1999-07-19 2006-09-19 Rsa Security Inc. System and methods for maintaining and distributing personal security devices
US7373517B1 (en) * 1999-08-19 2008-05-13 Visto Corporation System and method for encrypting and decrypting files
US20020046169A1 (en) * 1999-10-01 2002-04-18 Cardinalcommerce Corporation Secure and efficient payment processing system
WO2001026062A1 (en) * 1999-10-01 2001-04-12 Cardinalcommerce.Com, Inc. Secure and efficient payment processing system
US8676694B2 (en) 1999-10-01 2014-03-18 Cardinalcommerce Corporation Secure and efficient payment processing system
US20090119205A1 (en) * 1999-10-01 2009-05-07 Cardinalcommerce Corporation Secure and efficient payment processing system
US20100241570A1 (en) * 1999-10-01 2010-09-23 Cardinalcommerce Corporation Secure and efficient payment processing system
US10872343B2 (en) 1999-10-01 2020-12-22 Cardinalcommerce Corporation Secure and efficient payment processing system
US7742967B1 (en) 1999-10-01 2010-06-22 Cardinalcommerce Corporation Secure and efficient payment processing system
US8170954B2 (en) 1999-10-01 2012-05-01 Cardinalcommerce Corporation Secure and efficient payment processing system with account holder defined transaction limitations
US9430769B2 (en) 1999-10-01 2016-08-30 Cardinalcommerce Corporation Secure and efficient payment processing system
WO2001031840A1 (en) * 1999-10-29 2001-05-03 Nokia Corporation Method and arrangement for reliably identifying a user in a computer system
US6928558B1 (en) 1999-10-29 2005-08-09 Nokia Mobile Phones Ltd. Method and arrangement for reliably identifying a user in a computer system
US7647403B2 (en) * 1999-11-29 2010-01-12 British Telecommunications Public Limited Company Method for processing a request for access to a data network
US20020188738A1 (en) * 1999-11-29 2002-12-12 Gray Robert H M Data networks
US20010044893A1 (en) * 2000-01-07 2001-11-22 Tropic Networks Onc. Distributed subscriber management system
GB2399435A (en) * 2000-01-10 2004-09-15 Sun Microsystems Inc Using generic user name and password to generate a token to access a service.
US20010037451A1 (en) * 2000-03-06 2001-11-01 Bhagavatula Ravishankar S. Centralized identity authentication for electronic communication networks
US10019712B2 (en) 2000-03-06 2018-07-10 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US9990627B2 (en) 2000-03-06 2018-06-05 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US8321912B2 (en) 2000-03-06 2012-11-27 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US10032165B2 (en) 2000-03-06 2018-07-24 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US10032166B2 (en) 2000-03-06 2018-07-24 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US20100325694A1 (en) * 2000-03-06 2010-12-23 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US7140036B2 (en) 2000-03-06 2006-11-21 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US10223695B2 (en) 2000-03-06 2019-03-05 Cardinalcommerce Corporation Centralized identity authentication for electronic communication networks
US7428641B2 (en) * 2000-03-09 2008-09-23 Microsoft Corporation Session-state manager
US7478245B2 (en) * 2000-03-09 2009-01-13 Microsoft Corporation Session-state manager
US6877095B1 (en) * 2000-03-09 2005-04-05 Microsoft Corporation Session-state manager
US20050060553A1 (en) * 2000-03-09 2005-03-17 Microsoft Corporation Session-state manager
US20050060548A1 (en) * 2000-03-09 2005-03-17 Microsoft Corporation Session-state manager
US20030233554A1 (en) * 2000-04-09 2003-12-18 Assaf Litai Network content access control
US6928545B1 (en) * 2000-04-09 2005-08-09 Vidius Inc. Network content access control
US7308709B1 (en) * 2000-04-21 2007-12-11 Microsoft Corporation System and method for managing and authenticating services via service principal names
WO2001086392A3 (en) * 2000-05-10 2003-02-27 Procter & Gamble Method and apparatus for centralized authentication
WO2001086392A2 (en) * 2000-05-10 2001-11-15 The Procter & Gamble Company Method and apparatus for centralized authentication
US9252955B2 (en) 2000-08-18 2016-02-02 United States Postal Service Apparatus and methods for the secure transfer of electronic data
US20030177357A1 (en) * 2000-08-18 2003-09-18 Chamberlin Charles R. Apparatus and methods for the secure transfer of electronic data
US20080077804A1 (en) * 2000-08-21 2008-03-27 The United States Postal Service Delivery point validation system
US20060143434A1 (en) * 2000-08-21 2006-06-29 United States Postal Service Delivery point validation system
US7302582B2 (en) 2000-08-21 2007-11-27 United States Postal Service Delivery point validation system
US8117462B2 (en) 2000-08-21 2012-02-14 United States Postal Service Delivery point validation system
US8291234B2 (en) * 2000-08-21 2012-10-16 United States Postal Service Delivery point validation system
US8677140B2 (en) 2000-08-21 2014-03-18 United States Postal Service Delivery point validation system
US20020035618A1 (en) * 2000-09-20 2002-03-21 Mendez Daniel J. System and method for transmitting workspace elements across a network
US20070174433A1 (en) * 2000-09-20 2007-07-26 Visto Corporation System and method for using a global translator to synchronize workspace elements across a network
US7225231B2 (en) 2000-09-20 2007-05-29 Visto Corporation System and method for transmitting workspace elements across a network
US8738731B2 (en) 2000-09-26 2014-05-27 Juniper Networks, Inc. Method and system for providing secure access to private networks
US7774455B1 (en) 2000-09-26 2010-08-10 Juniper Networks, Inc. Method and system for providing secure access to private networks
US7865843B2 (en) 2000-09-26 2011-01-04 Juniper Networks, Inc. Dynamic toolbar for markup language document
US9183188B2 (en) 2000-09-26 2015-11-10 Juniper Networks, Inc. Dynamic toolbar for markup language document
US20110131478A1 (en) * 2000-09-26 2011-06-02 Juniper Networks, Inc. Method and system for modifying script portions of requests for remote resources
US7877459B2 (en) 2000-09-26 2011-01-25 Juniper Networks, Inc. Method and system for modifying requests for remote resources
US20060218242A1 (en) * 2000-09-26 2006-09-28 Theron Tock Method and system for modifying requests for remote resources
US7136896B1 (en) 2000-09-26 2006-11-14 Juniper Networks, Inc. Dynamic toolbar for markup language document
US8326981B2 (en) 2000-09-26 2012-12-04 Juniper Networks, Inc. Method and system for providing secure access to private networks
US7085817B1 (en) 2000-09-26 2006-08-01 Juniper Networks, Inc. Method and system for modifying requests for remote resources
US20110161799A1 (en) * 2000-09-26 2011-06-30 Juniper Networks, Inc. Dynamic toolbar for markup language document
US20100263035A1 (en) * 2000-09-26 2010-10-14 Juniper Networks, Inc. Method and system for providing secure access to private networks
US7865569B1 (en) 2000-09-26 2011-01-04 Juniper Networks, Inc. Method and system for modifying script portions of requests for remote resources
US20070073806A1 (en) * 2000-09-26 2007-03-29 Juniper Networks, Inc. Dynamic toolbar for markup language document
GB2371957A (en) * 2000-10-23 2002-08-07 Motorola Inc Method of authenticating a network access server
GB2371957B (en) * 2000-10-23 2003-03-26 Motorola Inc Method to authenticate a network access server to an authentication server
US20100049795A1 (en) * 2000-11-03 2010-02-25 Juniper Networks, Inc. Method and system for providing secure access to private networks
US9444791B2 (en) 2000-11-03 2016-09-13 Pulse Secure, Llc Method and system for providing secure access to private networks
US9130936B2 (en) 2000-11-03 2015-09-08 Pulse Secure, Llc Method and system for providing secure access to private networks
US20080181408A1 (en) * 2001-03-29 2008-07-31 Arcot Systems, Inc. Method And Apparatus For Secure Cryptographic Key Generation, Certification And Use
US8559639B2 (en) 2001-03-29 2013-10-15 Ca, Inc. Method and apparatus for secure cryptographic key generation, certification and use
US7340773B2 (en) 2001-04-12 2008-03-04 Christopher Paul Edwards Multi-stage authorisation system
GB2374498A (en) * 2001-04-12 2002-10-16 Intercede Ltd Multi-stage authorisation system
US20040143741A1 (en) * 2001-04-12 2004-07-22 Edwards Christopher Paul Multi-stage authorisation system
GB2374498B (en) * 2001-04-12 2004-02-18 Intercede Ltd Multi-stage authorisation system
US7725725B1 (en) 2001-04-26 2010-05-25 Gary Odom User-selectable signatures
US8429415B1 (en) 2001-04-26 2013-04-23 Tierra Intelectual Borinquen User-selectable signatures
US7350078B1 (en) * 2001-04-26 2008-03-25 Gary Odom User selection of computer login
US9026798B2 (en) 2001-04-26 2015-05-05 Tierra Intelectual Borinquen, Inc. User selectable signature
US20030105966A1 (en) * 2001-05-02 2003-06-05 Eric Pu Authentication server using multiple metrics for identity verification
US20070015492A1 (en) * 2001-05-24 2007-01-18 International Business Machines Corporation Methods and apparatus for restricting access of a user using a cellular telephnoe
US7715823B2 (en) * 2001-05-24 2010-05-11 International Business Machines Corporation Methods and apparatus for restricting access of a user using a cellular telephone
US20020177433A1 (en) * 2001-05-24 2002-11-28 International Business Machines Corporation Methods and apparatus for restricting access of a user using a cellular telephone
US7133662B2 (en) * 2001-05-24 2006-11-07 International Business Machines Corporation Methods and apparatus for restricting access of a user using a cellular telephone
US8209753B2 (en) 2001-06-15 2012-06-26 Activcard, Inc. Universal secure messaging for remote security tokens
US20020194499A1 (en) * 2001-06-15 2002-12-19 Audebert Yves Louis Gabriel Method, system and apparatus for a portable transaction device
US20040143730A1 (en) * 2001-06-15 2004-07-22 Wu Wen Universal secure messaging for remote security tokens
WO2003010892A2 (en) * 2001-07-23 2003-02-06 Avaya Technology Corp. Method and apparatus for providing communications security using a remote server
WO2003010892A3 (en) * 2001-07-23 2003-10-30 Avaya Technology Corp Method and apparatus for providing communications security using a remote server
US6961851B2 (en) 2001-07-23 2005-11-01 Avaya Technology Corp. Method and apparatus for providing communications security using a remote server
US20030018901A1 (en) * 2001-07-23 2003-01-23 Burritt David R. Method and apparatus for providing communications security using a remote server
US8078879B2 (en) 2001-08-10 2011-12-13 Cryptomathic A/S Data certification method and apparatus
US7725723B2 (en) 2001-08-10 2010-05-25 Peter Landrock Data certification method and apparatus
US20050010758A1 (en) * 2001-08-10 2005-01-13 Peter Landrock Data certification method and apparatus
US8549308B2 (en) 2001-08-10 2013-10-01 Cryptomathic Ltd. Data certification method and system
US20100191977A1 (en) * 2001-08-10 2010-07-29 Peter Landrock Data certification method and apparatus
US20030065956A1 (en) * 2001-09-28 2003-04-03 Abhijit Belapurkar Challenge-response data communication protocol
US20060242241A1 (en) * 2001-11-02 2006-10-26 Neoteris, Inc. Dual authentication of a requestor using a mail server and an authentication server
US20110208838A1 (en) * 2001-11-02 2011-08-25 Juniper Networks, Inc. Method and system for providing secure access to private networks with client redirection
US20070055864A1 (en) * 2001-11-02 2007-03-08 Juniper Networks, Inc. Dual authentication of a requestor using a mail server and an authentication server
US20040039827A1 (en) * 2001-11-02 2004-02-26 Neoteris, Inc. Method and system for providing secure access to private networks with client redirection
US7631084B2 (en) 2001-11-02 2009-12-08 Juniper Networks, Inc. Method and system for providing secure access to private networks with client redirection
US7958245B2 (en) 2001-11-02 2011-06-07 Juniper Networks, Inc. Method and system for providing secure access to private networks with client redirection
US20100057845A1 (en) * 2001-11-02 2010-03-04 Juniper Networks, Inc. Method and system for providing secure access to private networks with client redirection
WO2003041360A3 (en) * 2001-11-02 2003-09-12 Neoteris Inc Method and system for providing secure access to resources on private networks
CN1605181B (en) * 2001-11-02 2011-09-07 丛林网络公司 Method and system for providing secure access to resources on private networks
US7146403B2 (en) 2001-11-02 2006-12-05 Juniper Networks, Inc. Dual authentication of a requestor using a mail server and an authentication server
US7877440B2 (en) 2001-11-02 2011-01-25 Juniper Networks, Inc. Web resource request processing
US20110145917A1 (en) * 2001-12-04 2011-06-16 Philippe Levy Method and system for facilitating memory and application management on a secured token
US7874492B2 (en) 2001-12-04 2011-01-25 Visa U.S.A. Inc. Method and system for facilitating memory and application management on a secured token
US7243853B1 (en) 2001-12-04 2007-07-17 Visa U.S.A. Inc. Method and system for facilitating memory and application management on a secured token
US8215563B2 (en) 2001-12-04 2012-07-10 Visa International Service Association Method and system for facilitating memory and application management on a secured token
US7529778B1 (en) 2001-12-12 2009-05-05 Microsoft Corporation System and method for providing access to consistent point-in-time file versions
US20030144849A1 (en) * 2001-12-14 2003-07-31 Kakivaya Gopalakrishna Reddy System and method for generalized and distributed scalable eventing system
US7325065B1 (en) * 2001-12-21 2008-01-29 Aol Llc, A Delaware Limited Liability Company Identifying unauthorized communication systems using a system-specific identifier
US7421733B2 (en) * 2002-02-06 2008-09-02 Hewlett-Packard Development Company, L.P. System and method for providing multi-class processing of login requests
US20030149900A1 (en) * 2002-02-06 2003-08-07 Glassman Steven Charles System and method for providing multi-class processing of login requests
US7587408B2 (en) 2002-03-21 2009-09-08 United States Postal Service Method and system for storing and retrieving data using hash-accessed multiple data stores
US20030182568A1 (en) * 2002-03-21 2003-09-25 Snapp Robert F. Method and system for storing and retrieving data using hash-accessed multiple data stores
US7664731B2 (en) 2002-03-21 2010-02-16 United States Postal Service Method and system for storing and retrieving data using hash-accessed multiple data stores
US20060020575A1 (en) * 2002-03-21 2006-01-26 United States Postal Service Method and system for storing and retrieving data using hash-accessed multiple data stores
CN1663171B (en) * 2002-05-15 2010-05-05 高通股份有限公司 System and method for using acoustic digital signature generator as oracle
US20030229718A1 (en) * 2002-06-06 2003-12-11 Neoteris, Inc. Method and system for providing secure access to private networks
US7620719B2 (en) 2002-06-06 2009-11-17 Juniper Networks, Inc. Method and system for providing secure access to private networks
US20100169215A1 (en) * 2002-06-12 2010-07-01 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US20030233327A1 (en) * 2002-06-12 2003-12-18 Cardinal Commerce Corporation Universal merchant platform for payment authentication
US8140429B2 (en) 2002-06-12 2012-03-20 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US8645266B2 (en) 2002-06-12 2014-02-04 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US20110167002A1 (en) * 2002-06-12 2011-07-07 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US8650118B2 (en) 2002-06-12 2014-02-11 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US7051002B2 (en) 2002-06-12 2006-05-23 Cardinalcommerce Corporation Universal merchant platform for payment authentication
US20030233584A1 (en) * 2002-06-14 2003-12-18 Microsoft Corporation Method and system using combinable computational puzzles as challenges to network entities for identity check
US20060053288A1 (en) * 2002-06-17 2006-03-09 Cryptolog Interface method and device for the on-line exchange of content data in a secure manner
FR2841070A1 (en) * 2002-06-17 2003-12-19 Cryptolog Interface system for the on-line exchange of contents data in a secure manner, used e.g. in electronic commerce etc., uses personal cryptographic data which is encoded to secure exchange of contents data
WO2003107587A1 (en) * 2002-06-17 2003-12-24 Cryptolog Interface method and device for the on-line exchange of contents data in a secure manner
US7890643B2 (en) 2002-06-26 2011-02-15 Microsoft Corporation System and method for providing program credentials
US20040003081A1 (en) * 2002-06-26 2004-01-01 Microsoft Corporation System and method for providing program credentials
US8230026B2 (en) 2002-06-26 2012-07-24 Research In Motion Limited System and method for pushing information between a host system and a mobile data communication device
US20090164795A1 (en) * 2002-06-26 2009-06-25 Microsoft Corporation System and method for providing program credentials
US7549053B2 (en) 2002-09-06 2009-06-16 United States Postal Service Method and system for efficiently retrieving secured data by securely pre-processing provided access information
US7159119B2 (en) * 2002-09-06 2007-01-02 United States Postal Service Method and system for efficiently retrieving secured data by securely pre-processing provided access information
US20040049682A1 (en) * 2002-09-06 2004-03-11 Wilson James D. Method and system for efficiently retrieving secured data by securely pre-processing provided access information
US7647504B2 (en) * 2002-09-06 2010-01-12 United States Postal Service Method and system for efficiently retrieving secured data by securely pre-processing provided access information
US20070094511A1 (en) * 2002-09-06 2007-04-26 The United States Postal Service Method and system for efficiently retrieving secured data by securely pre-processing provided access information
US8548923B2 (en) 2002-10-07 2013-10-01 Sonia Reed Method and system for facilitating data access and management on a secure token
US9430666B2 (en) 2002-10-07 2016-08-30 Visa International Service Association Method and system for facilitating data access and management on a secure token
US20040139021A1 (en) * 2002-10-07 2004-07-15 Visa International Service Association Method and system for facilitating data access and management on a secure token
US7552470B2 (en) * 2002-11-21 2009-06-23 Honeywell International Inc. Generic security infrastructure for COM based systems
US20040103323A1 (en) * 2002-11-21 2004-05-27 Honeywell International Inc. Generic security infrastructure for COM based systems
US20040123152A1 (en) * 2002-12-18 2004-06-24 Eric Le Saint Uniform framework for security tokens
US20080289023A1 (en) * 2002-12-19 2008-11-20 Patrick Ryan Wardrop Method and System for Peer-to-Peer Authorization
US7451217B2 (en) 2002-12-19 2008-11-11 International Business Machines Corporation Method and system for peer-to-peer authorization
US20040122958A1 (en) * 2002-12-19 2004-06-24 International Business Machines Corporation Method and system for peer-to-peer authorization
US7877480B2 (en) 2002-12-19 2011-01-25 International Business Machines Corporation Method and system for peer-to-peer authorization
WO2004093381A1 (en) * 2003-04-16 2004-10-28 Telefonaktiebolaget Lm Ericsson (Publ) Authentication method
US20060236384A1 (en) * 2003-04-16 2006-10-19 Fredrik Lindholm Authentication method
US8745715B2 (en) * 2003-04-16 2014-06-03 Telefonaktiebolaget Lm Ericsson (Publ) Password-based authentication system and method in group network
US20040221174A1 (en) * 2003-04-29 2004-11-04 Eric Le Saint Uniform modular framework for a host computer system
US20040218762A1 (en) * 2003-04-29 2004-11-04 Eric Le Saint Universal secure messaging for cryptographic modules
EP1473618A2 (en) * 2003-04-29 2004-11-03 Activcard Inc. Uniform modular framework for a host computer system
US10554393B2 (en) 2003-04-29 2020-02-04 Assa Abloy Ab Universal secure messaging for cryptographic modules
EP1473618A3 (en) * 2003-04-29 2005-03-16 Activcard Inc. Uniform modular framework for a host computer system
US20040260946A1 (en) * 2003-06-20 2004-12-23 Cahill Conor P. User not present
US7463590B2 (en) 2003-07-25 2008-12-09 Reflex Security, Inc. System and method for threat detection and response
US20050018618A1 (en) * 2003-07-25 2005-01-27 Mualem Hezi I. System and method for threat detection and response
US7290278B2 (en) 2003-10-02 2007-10-30 Aol Llc, A Delaware Limited Liability Company Identity based service system
US8583928B2 (en) * 2003-10-27 2013-11-12 Jp Morgan Chase Bank Portable security transaction protocol
US20120260093A1 (en) * 2003-10-27 2012-10-11 Jp Morgan Chase Bank Portable Security Transaction Protocol
US20050123140A1 (en) * 2003-12-04 2005-06-09 Feghali Wajdi K. Technique for implementing a security algorithm
US7747020B2 (en) * 2003-12-04 2010-06-29 Intel Corporation Technique for implementing a security algorithm
US20060195595A1 (en) * 2003-12-19 2006-08-31 Mendez Daniel J System and method for globally and securely accessing unified information in a computer network
US20050136964A1 (en) * 2003-12-22 2005-06-23 Le Saint Eric F. Intelligent remote device
US20050138380A1 (en) * 2003-12-22 2005-06-23 Fedronic Dominique L.J. Entry control system
US10417849B2 (en) 2003-12-22 2019-09-17 Assa Abloy Ab Entry control system
US7907935B2 (en) 2003-12-22 2011-03-15 Activcard Ireland, Limited Intelligent remote device
US20050144451A1 (en) * 2003-12-30 2005-06-30 Entrust Limited Method and apparatus for providing electronic message authentication
US20050149761A1 (en) * 2003-12-30 2005-07-07 Entrust Limited Method and apparatus for securely providing identification information using translucent identification member
US9100194B2 (en) 2003-12-30 2015-08-04 Entrust Inc. Method and apparatus for providing authentication between a sending unit and a recipient based on challenge usage data
US10009378B2 (en) 2003-12-30 2018-06-26 Entrust, Inc. Method and apparatus for providing authentication using policy-controlled authentication articles and techniques
US20070005967A1 (en) * 2003-12-30 2007-01-04 Entrust Limited Method and apparatus for providing authentication between a sending unit and a recipient based on challenge usage data
US9876793B2 (en) 2003-12-30 2018-01-23 Entrust, Inc. Offline methods for authentication in a client/server authentication system
US20050144449A1 (en) * 2003-12-30 2005-06-30 Entrust Limited Method and apparatus for providing mutual authentication between a sending unit and a recipient
US9281945B2 (en) 2003-12-30 2016-03-08 Entrust, Inc. Offline methods for authentication in a client/server authentication system
US8612757B2 (en) 2003-12-30 2013-12-17 Entrust, Inc. Method and apparatus for securely providing identification information using translucent identification member
US8230486B2 (en) 2003-12-30 2012-07-24 Entrust, Inc. Method and apparatus for providing mutual authentication between a sending unit and a recipient
US9191215B2 (en) 2003-12-30 2015-11-17 Entrust, Inc. Method and apparatus for providing authentication using policy-controlled authentication articles and techniques
US20060156385A1 (en) * 2003-12-30 2006-07-13 Entrust Limited Method and apparatus for providing authentication using policy-controlled authentication articles and techniques
US9519770B2 (en) 2003-12-30 2016-12-13 Entrust, Inc. Transaction card for providing electronic message authentication
US20060015725A1 (en) * 2003-12-30 2006-01-19 Entrust Limited Offline methods for authentication in a client/server authentication system
US8966579B2 (en) 2003-12-30 2015-02-24 Entrust, Inc. Method and apparatus for providing authentication between a sending unit and a recipient based on challenge usage data
US8060915B2 (en) 2003-12-30 2011-11-15 Entrust, Inc. Method and apparatus for providing electronic message authentication
US8515068B2 (en) 2004-05-04 2013-08-20 Research In Motion Limited Challenge response-based device authentication system and method
US20050250473A1 (en) * 2004-05-04 2005-11-10 Research In Motion Limited Challenge response system and method
US7603556B2 (en) * 2004-05-04 2009-10-13 Research In Motion Limited Challenge response-based device authentication system and method
US7693797B2 (en) * 2004-06-21 2010-04-06 Nokia Corporation Transaction and payment system security remote authentication/validation of transactions from a transaction provider
US20050283444A1 (en) * 2004-06-21 2005-12-22 Jan-Erik Ekberg Transaction & payment system securing remote authentication/validation of transactions from a transaction provider
US7617256B2 (en) 2004-07-19 2009-11-10 Microsoft Corporation Remote file updates through remote protocol
US20060026165A1 (en) * 2004-07-19 2006-02-02 Microsoft Corporation Remote file updates through remote protocol
US8766823B2 (en) 2004-09-22 2014-07-01 Bekad Mgmt. Ii, Llc. Keyboard configurations
US20080098222A1 (en) * 2004-09-22 2008-04-24 Zilberman Arkady G Device with built-in user authentication and method for user authentication and identity theft protection
US7701364B1 (en) 2004-09-22 2010-04-20 Zilberman Arkady G User input authentication and identity protection
US20100302157A1 (en) * 2004-09-22 2010-12-02 Zilberman Arkady G Keyboard Configurations
US8065525B2 (en) 2004-09-22 2011-11-22 Bekad Mgmt. Ii, Llc Device with built-in user authentication and method for user authentication and identity theft protection
US7801925B2 (en) 2004-12-22 2010-09-21 United States Postal Service System and method for electronically processing address information
US20060276916A1 (en) * 2004-12-22 2006-12-07 Dearing Stephen M System and method for electronically processing address information
WO2006075917A2 (en) 2005-01-11 2006-07-20 Encap As Security code production method and methods of using the same, and programmable device therefor
WO2006075917A3 (en) * 2005-01-11 2007-04-05 Encap As Security code production method and methods of using the same, and programmable device therefor
US20080137861A1 (en) * 2005-01-11 2008-06-12 Encap As Security Code Production Method and Methods of Using the Same, and Programmable Device Thereof
AU2006205272B2 (en) * 2005-01-11 2010-12-02 Encap As Security code production method and methods of using the same, and programmable device therefor
US8165909B2 (en) 2005-05-17 2012-04-24 The United States Postal Service System and method for automated management of an address database
US20060271692A1 (en) * 2005-05-25 2006-11-30 Microsoft Corporation Data communication coordination with sequence numbers
US8332526B2 (en) 2005-05-25 2012-12-11 Microsoft Corporation Data communication protocol including negotiation and command compounding
US9071661B2 (en) 2005-05-25 2015-06-30 Microsoft Technology Licensing, Llc Data communication coordination with sequence numbers
US9438696B2 (en) 2005-05-25 2016-09-06 Microsoft Technology Licensing, Llc Data communication protocol
US8825885B2 (en) 2005-05-25 2014-09-02 Microsoft Corporation Data communication protocol
US20060271697A1 (en) * 2005-05-25 2006-11-30 Microsoft Corporation Data communication protocol
US8850025B2 (en) 2005-05-25 2014-09-30 Microsoft Corporation Data communication coordination with sequence numbers
US9332089B2 (en) 2005-05-25 2016-05-03 Microsoft Technology Licensing, Llc Data communication coordination with sequence numbers
US20060288405A1 (en) * 2005-06-01 2006-12-21 At&T Corp. Authentication management platform for managed security service providers
US7707626B2 (en) * 2005-06-01 2010-04-27 At&T Corp. Authentication management platform for managed security service providers
US20080161114A1 (en) * 2005-09-10 2008-07-03 Tencent Technology (Shenzhen) Company Limited Method, System and Apparatus for Game Data Transmission
US8689339B2 (en) * 2005-09-10 2014-04-01 Tencent Technology (Shenzhen) Company Limited Method, system and apparatus for game data transmission
WO2007035846A3 (en) * 2005-09-21 2008-11-27 Rsa Security Inc Authentication method and apparatus utilizing proof-of-authentication module
US7562221B2 (en) 2005-09-21 2009-07-14 Rsa Security Inc. Authentication method and apparatus utilizing proof-of-authentication module
US20070101152A1 (en) * 2005-10-17 2007-05-03 Saflink Corporation Token authentication system
US20070094503A1 (en) * 2005-10-21 2007-04-26 Novell, Inc. Techniques for key distribution for use in encrypted communications
US8281136B2 (en) * 2005-10-21 2012-10-02 Novell, Inc. Techniques for key distribution for use in encrypted communications
US9251323B2 (en) * 2005-11-24 2016-02-02 International Business Machines Corporation Secure access to a plurality of systems of a distributed computer system by entering passwords
US20080276308A1 (en) * 2005-11-24 2008-11-06 Thomas Graser Single Sign On
WO2007068099A1 (en) * 2005-12-12 2007-06-21 Entrust Limited Method and apparatus for providing authentication between a sending unit and a recipient based on challenge usage data
US8341127B1 (en) * 2006-02-02 2012-12-25 Emc Corporation Client initiated restore
US8042172B1 (en) * 2006-02-02 2011-10-18 Emc Corporation Remote access architecture enabling a client to perform an operation
US8886902B1 (en) 2006-02-02 2014-11-11 Emc Corporation Disk backup set access
US20100299731A1 (en) * 2006-03-08 2010-11-25 Steven Paul Atkinson Electronic System for Securing Electronic Services
US8869253B2 (en) * 2006-03-08 2014-10-21 Monitise Group Limited Electronic system for securing electronic services
US20080010673A1 (en) * 2006-07-07 2008-01-10 Fujitsu Limited System, apparatus, and method for user authentication
US8572387B2 (en) 2006-07-26 2013-10-29 Panasonic Corporation Authentication of a peer in a peer-to-peer network
US20080046740A1 (en) * 2006-07-26 2008-02-21 Matsushita Electric Industrial Co. Ltd Authentication of a peer in a peer-to-peer network
US20080040613A1 (en) * 2006-08-14 2008-02-14 David Carroll Challener Apparatus, system, and method for secure password reset
US7703676B2 (en) 2006-12-04 2010-04-27 Magtek, Inc. Encrypting the output of a card reader in a card authentication system
US20090173790A1 (en) * 2006-12-04 2009-07-09 Hart Annmarie D Encrypting the output of a card reader in a card authentication system
WO2008070638A3 (en) * 2006-12-04 2008-08-07 Magtek Inc Encrypting the output of a card reader in a card authentication system
WO2008070638A2 (en) * 2006-12-04 2008-06-12 Magtek Inc. Encrypting the output of a card reader in a card authentication system
US20080162687A1 (en) * 2006-12-28 2008-07-03 David Alan Scott Data acquisition system and method
US20080165970A1 (en) * 2007-01-05 2008-07-10 Chung Hyen V runtime mechanism for flexible messaging security protocols
US8522349B2 (en) 2007-05-25 2013-08-27 International Business Machines Corporation Detecting and defending against man-in-the-middle attacks
US20080295169A1 (en) * 2007-05-25 2008-11-27 Crume Jeffery L Detecting and defending against man-in-the-middle attacks
US8533821B2 (en) 2007-05-25 2013-09-10 International Business Machines Corporation Detecting and defending against man-in-the-middle attacks
US8935762B2 (en) 2007-06-26 2015-01-13 G3-Vision Limited Authentication system and method
US20100180328A1 (en) * 2007-06-26 2010-07-15 Marks & Clerk, Llp Authentication system and method
US20090119475A1 (en) * 2007-11-01 2009-05-07 Microsoft Corporation Time based priority modulus for security challenges
US9203620B1 (en) 2008-01-28 2015-12-01 Emc Corporation System, method and apparatus for secure use of cryptographic credentials in mobile devices
US8762210B2 (en) 2008-06-03 2014-06-24 Cardinalcommerce Corporation Alternative payment implementation for electronic retailers
US10157375B2 (en) 2008-06-03 2018-12-18 Cardinalcommerce Corporation Alternative payment implementation for electronic retailers
US10169748B2 (en) 2008-06-03 2019-01-01 Cardinalcommerce Corporation Alternative payment implementation for electronic retailers
US20090313147A1 (en) * 2008-06-03 2009-12-17 Balasubramanian Chandra S Alternative payment implementation for electronic retailers
US9258113B2 (en) 2008-08-29 2016-02-09 Red Hat, Inc. Username based key exchange
US20100189251A1 (en) * 2009-01-23 2010-07-29 Edward Curren Security Enhanced Data Platform
US8161527B2 (en) * 2009-01-23 2012-04-17 Edward Curren Security Enhanced Data Platform
US8762724B2 (en) 2009-04-15 2014-06-24 International Business Machines Corporation Website authentication
US20100269162A1 (en) * 2009-04-15 2010-10-21 Jose Bravo Website authentication
US20100313037A1 (en) * 2009-06-04 2010-12-09 Ward Rory A Collectible case authentication system, device and method
US20100332832A1 (en) * 2009-06-26 2010-12-30 Institute For Information Industry Two-factor authentication method and system for securing online transactions
US20110131415A1 (en) * 2009-11-30 2011-06-02 James Paul Schneider Multifactor username based authentication
US9225526B2 (en) * 2009-11-30 2015-12-29 Red Hat, Inc. Multifactor username based authentication
US8683609B2 (en) 2009-12-04 2014-03-25 International Business Machines Corporation Mobile phone and IP address correlation service
US20110138483A1 (en) * 2009-12-04 2011-06-09 International Business Machines Corporation Mobile phone and ip address correlation service
US20110293098A1 (en) * 2010-05-28 2011-12-01 Christina Fu Key recovery mechanism
US9137017B2 (en) * 2010-05-28 2015-09-15 Red Hat, Inc. Key recovery mechanism
US8386775B2 (en) * 2010-05-31 2013-02-26 Intercity Business Corporation Tolerant key verification method
US20110296170A1 (en) * 2010-05-31 2011-12-01 Intercity Business Corporation Tolerant key verification method
US8631277B2 (en) 2010-12-10 2014-01-14 Microsoft Corporation Providing transparent failover in a file system
US8533123B2 (en) 2010-12-13 2013-09-10 Magtek, Inc. Systems and methods for conducting contactless payments using a mobile device and a magstripe payment card
US9213968B2 (en) 2010-12-13 2015-12-15 Magtek, Inc. Systems and methods for conducting financial transactions using non-standard magstripe payment cards
US20120216046A1 (en) * 2011-02-22 2012-08-23 Raytheon Company System and Method for Decrypting Files
US8787567B2 (en) * 2011-02-22 2014-07-22 Raytheon Company System and method for decrypting files
US8838988B2 (en) 2011-04-12 2014-09-16 International Business Machines Corporation Verification of transactional integrity
US9754101B2 (en) 2011-06-01 2017-09-05 Paypal, Inc. Password check by decomposing password
US10599832B2 (en) 2011-06-01 2020-03-24 Paypal, Inc. Password check by decomposing password
US10152588B2 (en) 2011-06-01 2018-12-11 Paypal, Inc. Password check by decomposing password
US8850200B1 (en) 2011-06-21 2014-09-30 Synectic Design, LLC Method and apparatus for secure communications through a trusted intermediary server
US10284626B2 (en) 2011-06-29 2019-05-07 Microsoft Technology Licensing, Llc Transporting operations of arbitrary size over remote direct memory access
US9331955B2 (en) 2011-06-29 2016-05-03 Microsoft Technology Licensing, Llc Transporting operations of arbitrary size over remote direct memory access
US8856582B2 (en) 2011-06-30 2014-10-07 Microsoft Corporation Transparent failover
US9462039B2 (en) 2011-06-30 2016-10-04 Microsoft Technology Licensing, Llc Transparent failover
US8868921B2 (en) * 2011-07-20 2014-10-21 Daon Holdings Limited Methods and systems for authenticating users over networks
US20130024918A1 (en) * 2011-07-20 2013-01-24 Jason Scott Cramer Methods and systems for authenticating users over networks
US20130042314A1 (en) * 2011-08-11 2013-02-14 Bank Of America Corporation System and Method for Authenticating a User
US8752154B2 (en) * 2011-08-11 2014-06-10 Bank Of America Corporation System and method for authenticating a user
US10630781B2 (en) 2011-09-09 2020-04-21 Microsoft Technology Licensing, Llc SMB2 scaleout
US8788579B2 (en) 2011-09-09 2014-07-22 Microsoft Corporation Clustered client failover
US10263782B2 (en) * 2011-10-12 2019-04-16 Goldkey Corporation Soft-token authentication system
US20130097427A1 (en) * 2011-10-12 2013-04-18 Goldkey Security Corporation Soft-Token Authentication System
US9111077B2 (en) * 2012-01-16 2015-08-18 Sangfor Networks Company Limited Method and device for realizing remote login
US20130185781A1 (en) * 2012-01-16 2013-07-18 Sangfor Networks Company Limited Method and device for realizing remote login
US8917826B2 (en) 2012-07-31 2014-12-23 International Business Machines Corporation Detecting man-in-the-middle attacks in electronic transactions using prompts
US9021248B2 (en) * 2013-08-22 2015-04-28 SolidMobile, Inc. Secure access of mobile devices using passwords
US20160117494A1 (en) * 2014-10-24 2016-04-28 International Business Machines Corporation Keyboard neutral authentication
US9996685B2 (en) * 2014-10-24 2018-06-12 International Business Machines Corporation Keyboard neutral authentication
US11876908B2 (en) 2015-02-06 2024-01-16 eStorm Co., LTD Authentication method and system
US10574463B2 (en) * 2015-02-06 2020-02-25 eStorm Co., LTD Authentication method and system
US10277623B2 (en) * 2016-03-18 2019-04-30 AppBugs, INC. Method of detection of comptromised accounts
US9961053B2 (en) * 2016-05-27 2018-05-01 Dropbox, Inc. Detecting compromised credentials
US11195173B2 (en) 2016-07-15 2021-12-07 Cardinalcommerce Corporation Authentication to authorization bridge using enriched messages
US11741462B2 (en) 2016-07-15 2023-08-29 Cardinalcommerce Corporation Authentication to authorization bridge using enriched messages
US10084797B2 (en) * 2016-10-03 2018-09-25 Extreme Networks, Inc. Enhanced access security gateway
US20180097818A1 (en) * 2016-10-03 2018-04-05 Extreme Networks, Inc. Enhanced access security gateway
US11895240B2 (en) * 2016-12-15 2024-02-06 Nec Corporation System, apparatus, method and program for preventing illegal distribution of an access token
US11509478B2 (en) * 2018-05-08 2022-11-22 Visa International Service Association Password based threshold token generation
US20230074927A1 (en) * 2018-05-08 2023-03-09 Visa International Service Association Password based threshold token generation
US11722305B2 (en) * 2018-05-08 2023-08-08 Visa International Service Association Password based threshold token generation
WO2019216950A1 (en) * 2018-05-08 2019-11-14 Visa International Service Association Password based threshold token generation

Similar Documents

Publication Publication Date Title
US5491752A (en) System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens
US5418854A (en) Method and apparatus for protecting the confidentiality of passwords in a distributed data processing system
US6061790A (en) Network computer system with remote user data encipher methodology
US7231526B2 (en) System and method for validating a network session
US5666415A (en) Method and apparatus for cryptographic authentication
US6959394B1 (en) Splitting knowledge of a password
US8132020B2 (en) System and method for user authentication with exposed and hidden keys
US5751812A (en) Re-initialization of an iterated hash function secure password system over an insecure network connection
US6230269B1 (en) Distributed authentication system and method
Chang et al. An efficient and secure multi-server password authentication scheme using smart cards
US6173400B1 (en) Methods and systems for establishing a shared secret using an authentication token
US6883095B2 (en) System and method for password throttling
US7334255B2 (en) System and method for controlling access to multiple public networks and for controlling access to multiple private networks
US6539479B1 (en) System and method for securely logging onto a remotely located computer
EP2020797B1 (en) Client-server Opaque token passing apparatus and method
EP0511483B1 (en) Method and apparatus for authenticating users of a communication system to each other
JP5058600B2 (en) System and method for providing contactless authentication
US6732270B1 (en) Method to authenticate a network access server to an authentication server
US6996715B2 (en) Method for identification of a user's unique identifier without storing the identifier at the identification site
US20060195402A1 (en) Secure data transmission using undiscoverable or black data
US20030115452A1 (en) One time password entry to access multiple network sites
US20030188201A1 (en) Method and system for securing access to passwords in a computing network environment
CN111630811A (en) System and method for generating and registering secret key for multipoint authentication
WO2001013201A2 (en) Peer-to-peer network user authentication protocol
JP4612951B2 (en) Method and apparatus for securely distributing authentication credentials to roaming users

Legal Events

Date Code Title Description
STCF Information on status: patent grant

Free format text: PATENTED CASE

FPAY Fee payment

Year of fee payment: 4

AS Assignment

Owner name: COMPAQ INFORMATION TECHNOLOGIES GROUP, L.P., TEXAS

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DIGITAL EQUIPMENT CORPORATION;COMPAQ COMPUTER CORPORATION;REEL/FRAME:012447/0903;SIGNING DATES FROM 19991209 TO 20010620

FPAY Fee payment

Year of fee payment: 8

AS Assignment

Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., TEXAS

Free format text: CHANGE OF NAME;ASSIGNOR:COMPAQ INFORMANTION TECHNOLOGIES GROUP LP;REEL/FRAME:014102/0224

Effective date: 20021001

FPAY Fee payment

Year of fee payment: 12